"Assuming they implemented TLS 1.2 correctly, which some didn't." -> BlueCoat?

Basically everybody selling middleboxes screwed up, some worse than others but even the workaround in TLS 1.3 could best be understood as a hint that most middleboxes are ineffective garbage.