That's true. I remember Karsten Nohl's presentation about this at 33c3 and not much seems to have improved.

https://securityaffairs.com/54969/hacking/flight-bookings.ht...