One thing I don't grasp is: are the transactions part of their block's hash? Because if they're not, what's stopping an attacker adding random transactions to

One thing I don't grasp is: are the transactions part of their block's hash? Because if they're not, what's stopping an attacker adding random transactions to exising blocks, thus enabling double spending? If they are, how is it possible to validate a bitcoin transaction in less than 10 minutes?(the average target time to mine a btc block)