This is kinda what I would expect. If people can get away without valid certificates they will. Before Lets Encrypt I would find that every "intranet" site I used would have a cert expire every year. The people who run these are cheap fk's and use LE because they don't have to pay.