you'd need them to install a custom root cert if you wanted to MITM their secure traffic, and still wouldn't be able to do much with any app or service that pins or bundles its own certs without going through PKI system though?

I guess you could just block that traffic and let people deal with the breakage, maybe. I wonder how common it actually is.