TL;DR: Using self-signed certificates does not mean MITM is possible and using a certificate issued by a public CA does not mean MITM is impossible. But, it is more likely that MITM is possible if self-signed certificates are used because the clients dealing with self-signed certificates often deal with these in the wrong way.
Using a self-signed certificate does not allow MITM in general and using a certificate issued by a public CA does not protect against MITM in general. Apart from keeping the private key private the important protection against MITM attacks is not what kind of certificate is used on the server but how this certificate is checked on the client, i.e. if the server gets properly authenticated using a certificate or not.
The established way to authenticate a server using a certificate signed by a public CA is to check the subject of the certificate, trust chain, expiration etc - see SSL Certificate framework 101: How does the browser actually verify the validity of a given server certificate? for details. But if a client is not doing this checks or not doing these checks properly an attacker in the path might instead provide its own certificate and the client will not notice. In the past such kind of errors happened due to ignorance or due to bugs, for example not checking certificates at all, not validating the subject, not checking basic constraints etc.
With self-signed certificates proper authentication of the server is doable too: if the client knows the certificate to expect (or its public key, or a hash of it...) up front the client can check that the delivered certificate matches the expected one. This kind of verification is actually properly done in many use cases. But in many other cases it is done wrong: it is not uncommon that clients simply have all certificate checks disabled completely if they expect a self-signed certificate instead of expecting a specific self-signed certificate. With such broken clients MITM is easy since the attacker could just use an arbitrary certificate and the client will accept it.