If only. The biggest problem is that TLS middleboxes don't act like proxies. Proxies would suck in various ways but they're ultimately just a policy decision.
TLS offers end-to-end encryption but a true proxy splits things so that you've got two end-to-end channels with the proxy in the middle. This is fine, Alice talks to the Proxy, the Proxy talks to Bob. All fine.
But of course proxying sixty employees watching funny cat videos on YouTube needs lots of CPU power, which costs money, which means less profits for the middlebox vendors.
So middleboxes pull all sorts of shenanigans rather than actually act as a proxy. For example one trick is pass things through at first, eavesdropping but not actually proxying, then if the middlebox decides things are OK just stop eavesdropping and use a hardware fast path, otherwise drop the connection (wasting resources for both server and client) and when it's retried intercept the retry...
If you imagine this is a Black Hat talk you can probably fill in for yourself all sorts of hilarious things the bad guys might do here with this not-a-proxy.
So that's why this is a terrible outcome from a security point of view. But from a protocol agility point of view it's worse. The middleboxes make all sorts of arbitrary assumptions in their frantic attempts to avoid doing actual work and a working protocol needs to cope with every one of those assumptions or break those middleboxes.
Several big famous middlebox vendors shipped new firmware to make them "ready" for TLS 1.3. What that firmware does is make them TLS 1.2 full proxies. This has two consequences:
1. They now work. Both halves of the proxied connection are TLS 1.2, which works just fine as described above. As a full proxy when a client says "I want TLS 1.3" they can honestly say "Alas I only know TLS 1.2" and so there's no new considerations. So long as they proxy everything.
2. They have intolerably poor performance and will be quietly disabled outside of high threat environments. These boxes haven't anywhere near the brute power needed to really do TLS 1.2 proxy at line rate. Today's web is mostly encrypted, so everything slows to a crawl. The vendor upgrade docs explain how to "mitigate" this slowness by basically disabling the system.