Yeah for Gmail or some other big website. The real targets are usually the smaller corporate sites which are not in the preload list, but you wouldn't use those to demo with...
Well as long as the site has HSTS and the user had visited it at least once before the MiTM attempt.. But yeah a gazillion corporate sites won't have HSTS configured
In this case, the user runs the browser from a guest account - that the "attacker" controls. It would be prudent to start with a clean profile - so no "earlier" visits.
Locally-installed root CAs are allowed by HSTS, so if you added the HTTPS proxy to the root store, this would work without warning, unless you manually checked the certificate.
Of course, this only works on machines you're the admin of, which is why it's allowed.