It's nowhere near as rare as you think. There are sub-CA certs issued to private companies all the time, allowing them to MITM any default browser config.

The PKI is now totally broken.