There’s ways around tls, especially if everything isn’t using tls.

For instance, bgp hijacking has been used to obtain valid certificates by hijacking domain names. Yes there are mitigations for this, but not everyone enforces them.