Where I work, the company has a TLS 1.2 proxy as discussed in the article. The stated purpose is to intercept malware. It frequently fails, as the fine article

Where I work, the company has a TLS 1.2 proxy as discussed in the article. The stated purpose is to intercept malware. It frequently fails, as the fine article states, and people then either use their personal phone and 4G to wifi, or proxy traffic over ssh to a server they have at home. I can't imagine it's anything but "something must be done, we're doing something." Furthermore, as most large companies install these, won't malware authors just start proxying C&C traffic over ssh on port 80? Or use other non-interceptable secure channels?