They're present often enough that the people developing the TLS spec had to invent workarounds. Personally, I would've preferred to ignore the spec incompliant

They're present often enough that the people developing the TLS spec had to invent workarounds. Personally, I would've preferred to ignore the spec incompliant middleboxes, or even report an error about something meddling with the connection to the user when it's obvious they're the cause of any connectivity issues. That's not a very popular approach for spec designers, though, because they're afraid people will blame the new software rather than the Enterprise™ NetworkProtection© box they paid six figures for. After all, the software is what changed, not the box!