That's entirely possible and wouldn't be the first time that an exit relay's upstream or data center is responsible for MitM attacks.