In our analysis of the RMP initialization, we observed that the malicious hypervisor running on the x86 cores can still create dirty cachelines pointing to DRAM. [...] As depicted in (c), the malicious hypervisor can use the primitive to get arbitrary unchecked writes to RMP memory.
So it would seem it's easy as long as you managed to install a malicious hypervisor...
Of course not great, with supply chain attacks being a serious cause for concern. Still, hardly "easy" if it requires hijacking a core piece of infrastructure?
The following threat vectors are generally considered in scope for confidential computing: Software attacks: including attacks on the host’s software and firmware. This may include the operating system, hypervisor, BIOS, other software and workloads.If the infrastructure operator is untrusted, as in some models of confidential computing, then hypervisor replacements are both easy and an expected threat.