It seems to me that browsers ought to pop up a security warning for any site that tries to use an insecure cipher like RC4 or 3DES so the user is at least aware

It seems to me that browsers ought to pop up a security warning for any site that tries to use an insecure cipher like RC4 or 3DES so the user is at least aware. I say that simply because it's possible that even if a site supports something more secure, what's to stop a MITM from reporting differently during the protocol negotiation?