An important part is that no information is actually transmitted through the qubits. Information is only effectively "transferred" when measurements can be corr

An important part is that no information is actually transmitted through the qubits. Information is only effectively "transferred" when measurements can be correlated. So, you can pass a key through the qubit, but the other side won't know the key until the additional measurement information arrives for correlation. A third party also viewing the entangled qubit would necessarily modify the measurements also, causing correlation failure. A man-in-the-middle attack would only be effective if they also intercepted the measurement information and replaced it with their own. In which case, yes naturally someone who can intercept all your communication and replace it arbitrarily can arbitrarily control your communication. As is used today, signing the measurement information would be an effective mechanism for preventing this. The attacker should be unable to correctly sign their own measurement information, and so you will be able to detect that the key transfer is unreliable. Once the key is reliably transferred, then it's theoretically a secure one-time pad. That is, you know that it was transferred to the party at the other end of the entangled qubit, and that it was not intercepted along the way.