The encryption keys are generated on the device but can be exported in the app / through the API so you can back it up or migrate nodes. As for spoofing protection, it's mainly keeping your key secret and the fact that each device Mac address shows up as a specific color. I believe there's a warning if you see a device Mac with a new key from before (in case someone spoofs your Mac but doesn't have your key), but if you were to import your key into a new device I don't think there's any warning to others besides noticing the different Mac address / color.

And yeah the L1 looks really good - it uses the same nrf chip and lora radio as the rak4631 and uses one of the 2 gps options of the rak4631 (it might be slightly better than the other one which I picked but probably doesn't matter unless you're in an area where gps is tough). If I didn't have the rak and I didn't want to build (and didn't like the slightly less polished look of the wismesh builds), the L1 would definitely be a contender.