Yes, it's usually a fair amount of work, on most modern ECUs there is some form of signature based protection which will require an exploit chain to bypass, and

Yes, it's usually a fair amount of work, on most modern ECUs there is some form of signature based protection which will require an exploit chain to bypass, and then the need to write either software patches to enable introspection into the parameters necessary to tune, or to reverse engineer the protections on the factory calibration protocols if they were left in production builds. This is all possible with the electronic equivalent of a screwdriver, a Raspberry Pi, but requires a lot of reverse-engineering effort and understanding.