Yes, but they can also do so if you use a self-signed certificate, by just self-signing their own. There's no way that's less secure than a CA-signed cert.
CAs will always be able to MITM you. Like I said: "the notion of CAs is problematic."
There are two caveats:
1) certificate pinning: your browser has a hard-coded list of certificates for all major websites (e.g. Chromium: https://code.google.com/p/chromium/codesearch#chromium/src/n... (scroll down!))
2) there are add-ons (ie Certificate Patrol) that warn you when the certificate changes
If you want pinning, there are better solutions: http://patrol.psyced.org/