Good point, but what's the relative difficulty of recording all your MITM'd TLS traffic org-wide as plaintext versus attacking specific sites with custom JS to

Good point, but what's the relative difficulty of recording all your MITM'd TLS traffic org-wide as plaintext versus attacking specific sites with custom JS to exflitrate JS encryption keys? It's additional friction for lazy spying, mostly, and for a situation where TLS traffic is passively snooped and broken by other means than MITM.