MitM takes more effort and is less common. You're only fooling yourself by thinking about it as black and white. How about "it's just as easy to MitM me, but I have reduced how common eavesdropping will be by 80%" I want that. And with how common ISP surveillance is, the number is probably much higher than 80.
>There is no such thing as "kind of" secure, after all.
If you really want to get absolute, then you have to admit that any computer you have purchased parts for is not secure.
It's an arms race. If I have sensitive data, you install a tap to capture it. If I begin obscuring the data from you rtap, you begin injecting traffic to unobscure it.
If someone is trying to steal your data, they will not stop trying to steal it just because you applied ROT13 to it. Why do you think someone would just give up just because they now need to use an active attack? Active attacks are trivial once a tap is in place. We're not talking NSA research projects here; this shit has been going on since World War II. If they have a means to exploit your data, they will use it.
OE isn't about targeted attacks to get your data. This is about raising the cost of bulk eavesdropping. Yes, there are a lot of ways to easily do MitM, but all of those still cost more and have more opportunities for error and detection than a passive tap that is basically a giant tcpdump on the backbone.
If I paint my car an ugly color, it's half as likely to get stolen as if I paint it red. It's not a "security" measure because it doesn't result in a "secure car", but it is a measure that makes me less likely to be hit by a marginal effort attack.
Even if I leave the door unlocked and the keys under the seat.
>There is no such thing as "kind of" secure, after all.
If you really want to get absolute, then you have to admit that any computer you have purchased parts for is not secure.
Levels of security exist.