I understand the non-compliance network appliance issue and hence the wire hacks for 1.3. I'm asking about forced TLS-stripping's (e.g. by root certs) effectiv

I understand the non-compliance network appliance issue and hence the wire hacks for 1.3. I'm asking about forced TLS-stripping's (e.g. by root certs) effectiveness against malware encryption. If you're laying app level encryption on top of a connection... what are the boxes inspecting? Or are malware authors just really bad at network encryption and don't do any complex stuff?