The initial TLS handshake contains the hostname in plaintext, also DNS queries can be sniffed. On the other hand, MITM would be like changing a certificate in an attempt to alter traffic, this case is simple traffic blocking by doing packet inspection. (Which is also not nice obviously)