> fingerprint and target services

Or they could connect to the service.

> Server validation would have prevented that

No it wouldn't have. HTTPS does not ensure a server's contents are trustworthy.

> And before you come at me with I should be using a VPN to protect against these scenarios, I do that already

So you protect yourself from unlikely, irrelevant threats by... deliberately paying strangers to MiTM your traffic?