I sneakily edit a sneaky MITM attacker into your image:
The problem with this protocol is that Bob does not authenticate with Alice. That means a man-in-the-middle attacker who can manipulate the data-flow between Alice and Bob can intercept the initial connection attempt from Alice and respond with their own certificate.
Alice will then communicate securely with Eavesdropper, thinking she communicates with Bob.
Eavesdropper can then simultaneously build a secure connection with Bob while claiming to be Alice.
Now both Alice and Bob believe they are communicating with each other, while they are actually communicating with Eavesdropper. That means Eavesdropper can look at all their communication in cleartext and even manipulate it.
Either Alice needs to authenticate to Bob or Bob needs to authenticate to Alice. But how can they do that before a secure connection is established? Either by exchanging their certificates beforehand or by having their certificates signed by a trustworthy 3rd party (a certificate authority).