Hacker News Reader

If that were the case, they wouldn't have seen weird connectivity issues/behaviors.

why not? They discover the issue only because the attacker failed to renew the certificates.

Yeah, but just getting a hold of a valid certificate doesn't automatically mean a MITM. For that the network connections need to be intercepted too.