I'm not saying it's not a critical bug that should be fixed somehow. I just thought it seemed a bit of a stretch to call replacing the hypervisor with a malicious one "easy".
If the infrastructure operator is untrusted, as in some models of confidential computing, then hypervisor replacements are both easy and an expected threat.