[wbobeirne]

It's spoofable in the same way that a hash collision or guessing a password is "spoofable", given infinite time and / or energy you could. But the chain would move on while you're generating your spoof, and you're limited by the constraints of the physical world and your available computing power.

[SavantIdiot]

Not exactly... You just need the majority to agree that the new manipulated chain is the real chain. You don't need to find a SHA256 collision.