In doing genealogy, I've found numerous instances of illiterate ancestors who placed a simple "X" when asked to sign for something like a Revolutionary War pension. Did this vary much? And what kept someone from forging an X and taking someone else's pension?

It did vary quite a bit. A lot of those records you'll see with a simple "X" are actually transcriptions of the original. They might look old, because they are old, but they aren't necessarily the original, and when the transcriber transcribed them, they rendered all the signature marks as a simple "X". This applies to both handwritten transcriptions, as well as typed transcriptions such as in this example.

But if you look at an original document, this is less true, such as this example on page 301 of a book of Maryland records from the Revolutionary era. As you'll see, a couple of the marks look like "X"s, but one of them looks like a backward R, another looks like a capital "I" with an additional cross through it, another looks like a lowecase "t", and still another looks like the letters "uen" (or is ite "ner"?).

Here is another example from a 1772 contract of indentured servitude. At the bottom, you'll see John Andrews signs with a mark that looks like an X or a T, but right below that is Richard Andrews who makes a mark that looks nothing like an X or T at all.

Perhaps more enlightening is the book Scandinavian Immigrants in New York, 1630-1674 which contains facsimiles of the marks of many Scandinavian immigrants to New York in its first century of existence. Among them, you'll find the mark of Bernt Begge, the mark of Claes Carstensen, the mark of Aertse Vanderbilt, and the mark of Jan Pietersen van Holstein, none of which are a simple "X". You'll also find some actual literate signatures in there, too.

Related, this also somewhat carried over to branding marks, such as the "hallmarks" of goldsmiths as well as the earmarks branded onto livestock by farmers. They could be simple X's. People tended to avoid this, though, as exemplified above, for exactly the reason you wondered about: identity theft. But the chance of someone's identity being stolen purely out of a simple X as their signature mark was mitigated by having witnesses to whatever document it was that they were signing, who would be literate, and would usually be a representative of the government. An example of this comes from Oaths of Common Law by Robert Cole, published in 1859. Quoting from 1853 instructions for obtaining legal affidavits that could be used in English courts of law:

"Where any affidavit is sworn before any Judge or any Commissioner, by any person, who from his or her signature appears to be illiterate, the Judge's Clerk or Commissioner taking such affidavit shall certify or state in the jurat that the affidavit was read in his presence to the party making the same, and that such party seemed perfectly to understand the same, and also that the said party wrote his or her mark or signature in the presence of the Judge's Clerk or Commissioner taking the said affidavit."

In other words, a law clerk or commissioner had to read the legal instructions out loud to the illiterate person, and then witness them signing their mark for the mark to be legal. The clerk would sign their own name on the affidavit as well, indicating they had witnessed the marking. This mitigated the chance of forgery and identity theft, because it would mean that the law clerk/commissioner had conspired in the fraud. If a person was being defrauded, they could then get the witness to back them up that they weren't the person who signed the document. Forgery and identity theft certainly did happen, but usually not often enough to raise a huge concern among the legal authorities to prompt them to enact anything beyond the ordinary safeguards.

Anyway, signing by mark was common enough that the normal safeguards against forgery seemed to be deemed sufficient. As E. Jennifer Monaghan writes in Learning To Read and Write in Colonial America:

"No matter what script was used, writing was viewed by everyone, from governors to private individuals, as the single most essential element for authenticating an agreement. Like those who had signed the famous Mayflower Compact in 1620 on board the Mayflower as it sailed toward America, English Americans used quill pens and ink to give their assent to documents. Nonetheless, men and women did not need to know how to form the letters of their names in order to signal their agreement: their mark was as valid as their signature."

Nonetheless, forgery did happen, but an illiterate person's mark probably wasn't more susceptible than a literate person's signature at the time. As Stuart Hatfield points out in his article "Faking It: British Counterfeiting During the American Revolution" for the Journal of the American Revolution:

"For the most part [counterfeiting currency and bank notes] was not difficult as many of the advanced security measures that are used today to dissuade such actions were not in use. Even though bank notes had individual handwritten serial numbers and signatures, these were no deterrent as they were easily forged."

So, in fact, signing by mark may have even been safer in a way, because it required a witness, whereas a literate signature could be written with no witness, then forged and passed off without question.

But back to your specific question about Revolutionary War pensions: forgery definitely was an issue that the government concerned itself with. One famous case involved a man named James Reynolds who paid Revolutionary War veterans in a scheme to steal their pensions, and as insurance against his scheme being discovered, his wife Maria approached Alexander Hamilton for help, and seduced him into an affair. The Reynolds then blackmailed Hamilton by threatening to implicate him in the forgery scheme if he went public with his knowledge of what was going on. James Reynolds' scheme was discovered, anyway, and he attempted to exchange information of his wife's affair with Hamilton as a bargaining chip, but it didn't work. Whether Reynolds was targeting illiterate Revolutionary War veterans, or literate, or both, I do not know, but it does reveal that war vets could be victims of forgery and fraud.

As William Henry Glasson wrote in Federal Military Pensions in the United States about legislation attempting to protect against Revolutionary War pension fraud:

"There was a widespread feeling that the pension system had an important influence in lowering the moral tone and lessening the independence of large numbers of citizens. In many cases pension frauds were discovered which involved criminal acts of a grave character on the persons who had been respected and trusted. There were indications that many more frauds were committed than came to light."