It depends on your threat model. Attackers could try to specifically target the proxy itself. If everyone starts using a proxy malware authors would probably adapt. The dazzlespy malware uses a custom root CA and stops if a TLS intercepting proxy is used.