Maybee I overread anything, but in general a Man-in-the-Middle is everytime possible when the user is not able to check if his communication partner is trustworthy.
The 'Analysis of impact' only bespokes the probability, but not what can happen and what besides of vandalism can be done with a login. And which goal a attacker could have that is valuable enough to justify the effort. Maybee nothing?
The mitigations beside 'Short term - for users' are all reading for me like bullshit. Displaying the URL in the App will not change anything, when the user didn't understand what he see in the browser, why should he understand it in the app? Clearly, with a private/public key infrastructure, this could be fixed, but unrolling a thing expensive like this is questionable for a simple Man-in-the-Middle attack with this little impact.