HTTP/2's opportunistic encryption of http URIs using TLS appears to allow the possibility of man-in-the-middle attacks. Is that true?
Opportunistic encryption assumes only a passive attacker (i.e. sniffing only) and thus of course makes man-in-the-middle attacks by an active attacker (which can modify the connection) possible. This is not restricted to HTTP/2 but a general limitation of opportunistic encryption. See also Wikipedia about this topic.