They don't successfully spoof it; that would require a cert signed by a root CA the browser trusts, and they don't have that. So what you'll actually get is not a web page, but an SSL cert error warning from your browser. If you're technically inclined enough to click your way through to see the actual page, I think all you get is a generic "YouTube is blocked" (and blocking YouTube is the reason why they do it -- they don't have the bandwidth to support it or other streaming video).

Still, there will be a broken padlock icons in the browser.

As much as they can read the traffic, they can't spoofed the identity. Not without having their own root cert on the customer side.