You make an outgoing TLS connection, the MITM Proxy Meg intervenes, but you actually wanted MyBank
You->Meg (thinking she's MyBank): Hi, I'm looking for MyBank?
Meg->MyBank: Hi, I'm looking for MyBank?
MyBank->Meg: Yes, we're MyBank <cert for MyBank>
[ Meg inspects the cert ]
Meg->You: Yes, we're MyBank <cert for MyBank>
Now Meg stitches the TCP connection back together so you're talking to MyBank. She no longer eavesdrops.
This works for the business because now they're not paying for a box that can proxy your connection _and_ they're less likely to find that one of their "security" employees emptied your bank account. They feel comfortable that MyBank aren't bad guys, so they aren't scared that you'll, say, exfiltrate stolen corporate secrets via MyBank or download Malware from it.
In TLS 1.3 this doesn't work, because the conversation goes like this:
You->Meg (thinking she's MyBank): Hi, I'm looking for MyBank and I picked 14, and the letter Q
Meg->MyBank: Hi, I'm looking for MyBank and I picked 14, and the letter Q
MyBank->Meg: Cool, I picked a Banana and 209.
<Unintelligible encrypted data> [ Meg can't do anything with this ]
Or Meg could try picking her own Elliptic Curve Diffie Hellman values:
You->Meg (thinking she's MyBank): Hi, I'm looking for MyBank and I picked 14, and the letter Q
Meg->MyBank: Hi, I'm looking for MyBank and I picked 81, and the letter Z
MyBank->Meg: Cool, I picked a Banana and 209. <We're MyBank - encrypted data>
[ Meg now has a connection to MyBank, but she can't give it you because it doesn't work if you picked different values ]
In the medium term we expect corporations which do this will just clamp everything to TLS 1.2 with full proxying. This will be very expensive, and worse, but well, we did tell you not to do this, so now that's broken you get to keep both halves. Ordinary folks who aren't trying to put middleboxes everywhere get TLS 1.3, with better performance and more security.
Too many people are unaware that their connections to their banks etc from work are insecure because of corporate firewalls and what are (essentially) compromised certificate stores.