Yeah I kind of forgot exploit injection in the spur of the moment as of course I rushed to correct "someone on the internet".

ISP injecting ads is like annoying but if someone knows as much as Tom about TLS and totally skips rouge "airport wi-fi" can use his website to own someones else device that is the argument I should use for calling him or anyone else names on the internet.

I guess Kazakhstan example kind of covers it, because I do believe they would definetly deliver malicious payloads to dissidents.