I feel like this is unnecessarily reductive. The initial handshake is always fraught with security problems. I struggle to see a scenario in which a bad actor is able to give me the address of a bad machine, yet not be able to trick me into their host key being the correct one.
I would definitely however spend effort into verifying a host key that changes unexpectedly.
I would definitely however spend effort into verifying a host key that changes unexpectedly.