If bad guys can make a certificate dated February 2018 and valid until May 2021 that certificate will be accepted in Chrome despite not having any SCTs. A real one from that date probably does have SCTs but Chrome only required them in April 2018. Setting Expect-CT now might make Chrome reject that certificate for lacking SCTs if it was shown on a subsequent visit.
A year from the now the window is closed, Chrome will reject a certificate that says it was issued more recently and lacks SCTs, and it will also reject a certificate that says it was issued longer ago, because that violates Baseline Requirements on validity periods. But for now a February 2018 certificate could be valid yet not require SCTs.
All Google-owned TLDs are HSTS-pre-loaded, so if you use a domain in a Google TLD (e.g. example.app) then browsers always use HTTPS anyway. Unfortunately it's unlikely that many older, popular TLDs will pre-load HSTS so most users will be unprotected for the foreseeable future.
However, you only need 1 http website to pull off the attack, so its not really a problem that hsts is great at addressing since its opt i per server. The easy way to do this attack is control the local wifi, and make the login landing page malicious.