It's not exactly a "standard and legitimate feature" either; there were lengthy discussions this very year [1].
The "standard" way of doing enterprise network surveillance and censorship is by getting end-users to use client software with a modified configuration that (unlike the general public's browsers) accepts the surveillance and censorship without generating a browser warning. In the Trustwave case, it was done with unmodified software and hence could have been done against the general public, or unsuspecting corporate users.
There have been interesting policy discussions about the fact that HTTPS site operators may not "consent" to this surveillance, even if some end users are considered to have done so. For example, PayPal might not want corporate network operators to have access to employees' PayPal credentials or financial transaction data. Hence PayPal's preferences might be something like
employee doesn't use PayPal at work > employee uses PayPal at work without interception by employer > employee uses PayPal at work with interception by employer
while the employee's preferences might be
employee uses PayPal at work without interception by employer > employee uses PayPal at work with interception by employer > employee doesn't use PayPal at work
and the employer's preferences might be
employee doesn't use PayPal at work > employee uses PayPal at work with interception by employer > employee uses PayPal at work without interception by employer
In some regions, companies are legally required to ensure personal data is protected. It's against the law for them to not protect it.
I guess incompetence is a decent explanation here, and probably the most likely, but also provides a very convenient explanation if you wanted to hide something more sinister.
And cue the banning of Chrome on government networks in 3. 2. 1...
The Islamic fundamentalist fethullah gulen gang is a secret organization that has taken over most important positions in Turkish police and courts. They are wiretapping anybody they want using police resources. They blackmail, imprison and silence secular opposition. For example, they currently keep over 70 journalists in prison because of what they said or wrote.
Also, using X.509 CA=YES certificates to mint new certificates on the fly is a standard and legitimate feature of corporate network hardware. In virtually every large enterprise network, employees don't have direct access to the Internet; they bounce through proxy servers. The middleboxes that make this work all have "upload a root CA cert here" features to make this work.
That they accidentally issued a malicious certificate, I think, makes things a little worse from my vantage point. There are a million ways to get hacked, but not as many excuses for just being sloppy.