Yes, they couldn’t modify the webpage without breaking the cert signing giving the user an error, installing a ca cert on your devices and doing a mitm on your

Yes, they couldn’t modify the webpage without breaking the cert signing giving the user an error, installing a ca cert on your devices and doing a mitm on your traffic (which would be hard to predict if your device has their cert installed) or getting a already trust CA to forge Certs for them which once recovered would get that trusted CA dragged though the mud by the major browsers.