Consider: 4. Someone else logs unencrypted traffic for whatever reason and the attacker gets access to the log later.

MITM means that you need to be in the middle at the time of the attack and so is more limited than an attack that works on logs.