I think proxy/MitM is perfect when combined with BYOD and app cert pinning. The user needs to opt-in to the end-to-end-security undermining corporate network.

I think proxy/MitM is perfect when combined with BYOD and app cert pinning. The user needs to opt-in to the end-to-end-security undermining corporate network. An app can opt-out of such networks. In which case you'll just have to use it at home, or over the cellular data connection. An app that is sympathetic to or sold for "enterprise" use will allow use of the user-added MitM CA in the system root CA store. Finally, a "guest network" could be created if the enterprise wanted to enable users to use BYOD and any app as they are normally used. It's just a matter of everyone making an honest choice between end-to-end security and "enterprise" interception. That was always the choice.