Kazakhstan had plans to introduce country-wide MITM with certificates signed by a government agency, whose root certificate would have had to be marked as trusted if you wanted to use internet [1].
Many Russian government websites including the largest retail bank had their certificates revoked due to sanctions, which forced the government to start their own untrustworthy certificate center, whose root CA is trusted out of the box by Yandex Browser and has to be trusted if you wanted to access these sites [2].
[1]: https://en.wikipedia.org/wiki/Kazakhstan_man-in-the-middle_a...
[2]: (In Russian) https://www.gosuslugi.ru/tls
Certificate Transparency logs use Merkle Trees so that if they try to hide a certificate, it can be detected.
The system is designed to resist subversion, even by governments. While there are scenarios where a sufficiently-powerful attacker could successfully subvert the system, they run a high risk of being detected if they try. It's just not as simple as you imply.