The bad actor would also need to install a root for their custom CA on the end-user device.