You seem to be downplaying the seriousness of the bug to the point of making it seem trivial, and while I agree that there are many, much more serious types of

You seem to be downplaying the seriousness of the bug to the point of making it seem trivial, and while I agree that there are many, much more serious types of bugs that 1. don't require active MITM, and 2. the press don't give proportionate attention, it is only "trivial" in the same way that Yahoo not using SSL for their webmail is "trivial," or the way a website leaking an authentication cookie over HTTP is. Only here it's not just Yahoo's email; it's (almost) all applications. (Not to mention that you can use these "secure" channels to deliver e.g. memory corruption exploits.) If you don't have authenticity, the "secure" channel isn't worth very much.