A man in the middle attacker can intercept and send a different certificate (a self-signed one, maybe) to the browser. In this case, browser will show warning to the user and doesn't display's the green pad lock near the URL.
If a single user bypasses the warning, will he still be prone to a man in the middle attack?
How can this issue be overcome? Is it solely left to the end user?
If a user dismisses all warnings given by the browser, and clicks through, they will be vulnerable to MitM. You simply can't patch the end user.
The reason browsers don't outright remove the ability to click through the warnings is that there are many servers out there, that produce certificate errors because of misconfigurations (or the server admin insists on using self-signed certs). In other cases, it might not be possible for the webserver to be using anything other than a self-signed certificate (for example, if your router/printer wanted to use HTTPS on it's web interface, it wouldn't be possible for it to obtain a CA signed certificate). Completely preventing click through would make these sites inaccessible.
The primary purpose of HSTS is to tell the browser that it should always access the site over HTTPS, which is useful for preventing sslstrip attacks. The HSTS RFC also provides a non-normative recommendation to user-agent implementers to provide no recourse to users when a certificate error is encountered on site using HSTS. In other words, the user will not be allowed to click through*.
However, since this just a recommendation, and not a requirement, not all browsers implement this. For example, Chrome on Windows 10 does, while Firefox does not.
*Of course you can go into the browser's configuration settings and disable HSTS altogether, which will allow you to bypass this protection as well. But normal users are unlikely to be aware of this, so they probably won't be able to shoot themselves in the foot.
