If you rely on mTLS you highly likely run your own CA. You can probably say with confidence that no malicious certificates have been signed by your CA. So you

If you rely on mTLS you highly likely run your own CA. You can probably say with confidence that no malicious certificates have been signed by your CA. So you mitigate your exposure by ignoring certs without a valid chain of trust, which you're doing anyway. Am I missing something?