Whilst I'm sure you're right, I can't think of a single instance where a compromised private key was used to impersonate a website through MiTM. 2+ year expiry

Whilst I'm sure you're right, I can't think of a single instance where a compromised private key was used to impersonate a website through MiTM. 2+ year expiry on certificates has been pretty commonplace until LetsEncrypt's 90 day policy. It's absolutely possible that this could occur, but practically, the difference between a correctly issued but expired cert and a non-expired one is minor.