For anything public, it's anything varying from trivial to hard/annoying depending on your client settings, but never quite impossible. Even in the best-case scenario where you have DHT turned off and all the trackers in the torrent are using HTTPS, man-in-the-middle attacks are fairly doable for anything popular.