So you don't think that the corporate employees have the right to know then their company is doing MITM to monitor their HTTPS traffic?

We could argue over whether that qualifies as "legitimate", but in any case that doesn't require doing it silently and showing sites as secure. Browsing on such a network should show persistent warnings about every site whose traffic appears potentially intercepted. You can then knowingly continue browsing on that network if you consider it legitimate.

A corporate network (or any other end user) should have no trouble enabling some sort of explicit override option. Having the ability to override certs is fine; the problem is that it's default behavior.

Dell would (hopefully) be a lot more reluctant to ship one of these certs and show specific intentions by changing settings to allow this kind of override.