HTTP MITM doesn't need to be targeted, it could just as well be a crypto-miner script injected into every HTML response that passes through some box.

People need to stop pretending that HTTP injection is complicated enough to only happen in targeted scenarios, it's not, it's completely trivial.