Since more than a decade that MITM is not a mass event. It is a targeted event for selected users which are scored as having a low chance of discovering anomalous traffic. It first (publicly) started by government authorities sending fake updates to operating systems which then weaken the target machines or straight up RAT them.

Same case here.