Obtaining the initial certificate is somewhat vulnerable to MitM if the attacker can divert the verification request to a server under its control. Some countries (including Iran IIRC) went as far as using BGP announces to do that (which makes it very obvious).

Let's Encrypt uses [Multi-Perspective Validation](https://letsencrypt.org/2020/02/19/multi-perspective-validat...) in order to protect from most interception of the DV request.