Most anyone who is in a position to reliably MITM an HTTP site would also be in a position to install a certificate source (either as part of a “install this to access the web” program or similar).
It’s a necessary level of defense but it is NOT sufficient- especially if you never check certificates.
It’s a necessary level of defense but it is NOT sufficient- especially if you never check certificates.