If you can reliably intercept traffic between a host and the internet, then you can get Let's Encrypt (or any other ACME service) to issue a certificate for the host.

If you cannot reliably intercept such traffic, then you can't reliably use a self signed certificate to intercept the traffic.

So, the lock icon basically means "the coffee shop WiFi or your local puppet governement didn't spoof this connection, but AWS, a colo facility, the US/China/etc or a backbone provider may have".

That's much weaker than most people realize.

Edit: Because of this, an unpinned ACME certificate is actually weaker than a pinned self signed certificate for services that only have a few users.