An adversary doesn't have to decrypt the traffic, they just reroute to their own TLS site to trick users. Or they do broadcasts like LLMNR to grab things and th

An adversary doesn't have to decrypt the traffic, they just reroute to their own TLS site to trick users. Or they do broadcasts like LLMNR to grab things and there are some WPAD attacks. Firewall on many computers might also allow things through, to perform relay or direct password bruteforce attacks. There are so many attacks that are possible, decrypting traffic really isn't so interesting.