Hm, I think you're mixing some things. A nation state could be embedding root certificates via a vendor, see Lenovo superfish (I know this wasn't done by the government, but that somehow makes it even worse). But a nation state actor also could simply buy the latest exploit from HackingTeam/Cellebrite/GrayKey/<current exploit vendor>.

Let's encrypt is secure against MITM as far as I know because you still have to verify you own a given domain somehow. I cannot get a let's encrypt certificate for google.com for example.