This happens, see Superfish and friends. HPKP does not protect against this, it's an entirely different set of problem.

HPKP's only purpose is to protect against malicious or compromised CAs.