Is it really each app that verifies its own certificate? Or is it relying on an iOS/Android service to verify the chain of trust? I don't know what the UI would

Is it really each app that verifies its own certificate? Or is it relying on an iOS/Android service to verify the chain of trust? I don't know what the UI would look like, but at the time you connect to WiFi couldn't the user unwittingly accept a pushed certificate, functionally similar to the browser add exception button for an invalid certificate warning, but system wide? I disagree with the comment "go out of your way to fall victim to any MITM attack". If you're trusting employer provided or controlled equipment and haven't personally verified the certificate lists, they totally could MITM your connections without your knowledge if they've already added the exceptions. I know some employers do this, and I know network equipment vendor sales staff have used the ability to MITM employees as an explicit product feature and sales tactic including boasting about the ease with which they can procure faked certs for Google, Microsoft, et al, for this purpose.