Hacker News Reader

why not? They discover the issue only because the attacker failed to renew the certificates.

Yeah, but just getting a hold of a valid certificate doesn't automatically mean a MITM. For that the network connections need to be intercepted too.