Comment by InsidiousWombat

Those features are mostly to stop VM-to-VM attacks. Host will always be able to mess with it one way or another and partly it is just needed.

AMD SEV technically encrypts guest memory with key that is unavailable to hypervisor but there are still other ways to mess with VM inside, like via IO devices or the provided storage.