Apparently it's also outside the scope of their bug fixing program, despite being trivially remotely exploitable to get privileged code execution.

Man in the middle attacks may be "out of scope" for AMD, but they're still "in scope" for actual attackers.

Ignoring them is indefensibly incompetent. A policy of ignoring them is a policy of being indefensibly incompetent.

The only thing cited here is a response from their bug bounty program. Excluding MITM from a bug bounty is perfectly legitimate. Actually, excluding anything from a bounty program is.