This question already has an answer here:
If I connect using ssh to an ip address of a server and have to trust a new fingerprint. How hard is it to be a man in the middle to redirect my ip connection?
I.e. How much risk am I taking if I just trust a fingerprint?
Also I am not asking about the consequences once an attacker successfully becomes a man-in-the-middle, I am asking about how easy/hard would it be to become a man-in-the-middle in the first place.