Comment by tptacek

You're confusing two issues. Enterprises can MITM traffic without being issued an intermediate CA=YES certificate; they just add their own root certificate to all their desktops.