Exactly as viable as any MitM against (unsecured) HTTP. The recommended way is still a 3xx-class redirect (consult your SEO) to the HTTPS version, because it's

Exactly as viable as any MitM against (unsecured) HTTP. The recommended way is still a 3xx-class redirect (consult your SEO) to the HTTPS version, because it's better than nothing -- in other words: - if an MitM already tampered with the response, they already have control and given the momentary circumstances there's nothing more anyone can do to save you; - else, if no one tampered with the response, then hopefully the site was configured properly and you ended up at the HTTPS version, receiving any HSTS headers the site owner may have issued, at which point you're either safe for the current session, or depending on any received HSTS headers, longer than that. Rinse and repeat.