I just got an answer from the hypervisor architects. It turns out
that the hardware _does_ prevent the device from sending MSI messages
to another partition. The OS _can_ write whatever it likes to the MSI
address and data registers. It can potentially lose interrupts (or, I
expect, get the device isolated by EEH) but it can't disrupt another
partition.
The OS however has to write the values the HV wants to
the device, or things won't work -- so the HV can just
as well do it itself. Also, pulling all the work into
the HV makes for a cleaner, more generic design (who
knows what hardware will show up within the next few
years, the HV interface had better be prepared).
Segher