I think OP's point is that no key establishment protocol - quantum or otherwise - protects against a true "man-in-the-middle" who can simply negotiate different

I think OP's point is that no key establishment protocol - quantum or otherwise - protects against a true "man-in-the-middle" who can simply negotiate different keys with both parties and transparently decrypt-encrypt in the middle. Of course, this isn't what QKD is supposed to solve, anyway. QKD does not address authentication, only key distribution.