Exactly. It's one of the reasons I use separate VMs per client when I freelance. I want to install the cert, so I don't see the cert warning messages or acciden

Exactly. It's one of the reasons I use separate VMs per client when I freelance. I want to install the cert, so I don't see the cert warning messages or accidentally click through a real MITM attack, but never on the host OS. That could let the client MITM all sorts of stuff like my email to other clients if Thunderbird syncs at a client site.