So if my understanding is correct, to be exploited the attacker would already need to be in a position to intercept your traffic, but this means when they do they can effectively impersonate anyone.

This could actually be an interesting attack vector for hacking IOT devices. If you control the DNS server the device connects to you can get it to trust literally anything.

Someone can correct me, but this change seems to be targeting people who are repackaging bitwarden and selling it. It does feel like we are trending the wrong direction though.