Browsers enforce that certificates are signed by two independent CT logs. The public keys of which is shipped by the browser. So a MITM would need to compromise a trusted CA and two CT logs to be able to pull off an attack undetected. Maybe not impossible but much more difficult than just a single CA compromise.

By using pinned certificates which are hardcoded into all the major browsers.

Yeah for some reason I don't feel confident about Mogadishu Internet Trust Corp and many others.