An attack on TAI would not impact the positional accuracy of any of the GNSS systems. Each GNSS systems uses its own realization of UTC(k) for its satellites. Even if this realization drifts away, it will not matter as all satellites still get a consistent timescale.
As for malicious actors and their potential effect on different realizations of UTC(k), the answer is quite a bit more complicated. The people managing the systems all over the world are a relatively small group that know each other quite well. There is a lot of trust in peers of this group and that shows in the whole setup of the system. While there are cross checks, these are meant more for unintentional errors in the system due to mistakes and equipment failure rather than for malicious participants. There are quite a few points where a malicious actor could inject errors in the path between atomic clock to the measurement being reported to the BIPM. While the BIPM does not blindly use any of the numbers and does a lot of checks (there is a reason why the publications of Circular-T takes so much time), a dedicated attacker could circumvent those.
That said, to get any significant difference between two UTC(k), one would need to slowly and consistently change the data, otherwise it would show up in one of the checks. So slowly that it would take years to get more than a few 100s of ns of time difference. And you would need to be able to manipulate all checks done on the system, which is close to impossible. E.g. the main way of time transfer is by using two way satellite time and frequency transfer (TWSTFT), i.e., measuring the difference between two realizations of UTC(k) with a dedicated satellite. The different regions of the world are split into separate groups, with each group having a coordinator and measure the differences in a round-robin fashion. The coordinator is responsible to transmitting the measurements to the BIPM. Additional to TWSTFT it is quite common to employ GNSS common view (think of measuring the relative offset to each visible satellite separately) to fill the gaps between TWSTFT sessions and decrease the measurement noise. While GNSS common view has more biases that cannot be compensated, it still offers precision in the same order of magnitude as TWSTFT, and thus, if calibrated regularly, also the same accuracy. Both GNSS common view and TWSTFT usually agree up to a few ns and the drift is usually slow. On top of that, for a sanity check, GNSS all in view (think of it the "normal" use of GNSS to get time) is used, even though it usually offers only an accuracy of <10ns. But that's already accurate enough to show most drifts that went unnoticed by the other systems.
To get any technically significant offset, you'd need to shift one target UTC(k) by more than 1µs to get any form of attack that would work on a system (at least on any I am aware of). And such a large offset would show up in the checks mentioned above.