Your TLS argument is true. That however does not make it any less insecure. You see, People around the world click 'proceed anyway' on so many of those website

Your TLS argument is true. That however does not make it any less insecure. You see, People around the world click 'proceed anyway' on so many of those websites. That is what happens when APs in coffee shops are misconfigured around the world. It is barely a useful prompt (if at all). And keep in mind this is a MITM we are talking about. He could simply, replace an instance of a website with his local version using 'http' instead of 'https'. The prompt would not even show up in this case.