If the MITM CA is installed (maybe only via Group Policy) then browsers relax their requirements for CA's. But some domains (like google) are strictly locked down to a specific set of CA's in Chrome.

Since TLS Interception is critical for some places to achieve their duties (either auditing in banking, or content filtering in schools) we will always have some kind of legit use for MITM CA boxes.

It gets slightly worse if you look at how AntiVirus generally installs CA's to do malware content filtering. Cloudflare publishes stats on what % of traffic they think has been MITM'd: https://malcolm.cloudflare.com/