Yes, I'd say most MITM scenarios are at the client end.

But you could, for example, be an evil network admin near the LastPass servers. That would let you MITM almost everyone who connects.