doesn't man in the middle only apply if there were forms or anything requiring user input. I.e. a portion of the website is real, but the user interaction is attacked with MITM.

If the risk is that an ISP would spoof the entire website at AI, then that can be done regardless of HTTPS.