Your attacker may share the data with a third party, but that's true of verified connections too.
But this is a very silly threat model, "I want exactly one person to be able to attack me at a time".
I don't see what's so hard about this:
Plaintext is worst (active and passive attacks possible)
Unverified TLS is better (active attacks possible)
Verified TLS is best (neither active nor passive attacks possible)
I'm sorry, but this is either incorrect or a gross misunderstanding of your own threat model.
Most people treat their online self as an extension of their physical self: that means banking information, private personal details, intimate communications, and everything else that's normally private by virtue of physical ownership needs to go through an authenticated channel.
You might not care that someone can't MITM your Wikipedia traffic, but you almost certainly care that someone can't MITM your tax returns or your medical records.
So presumably, you'd demand a cert from a trustworthy authority in those cases. But you still don't want your ISP to be able to inject ads into the recipe blog you're reading.
But I don't trust news.ycombinator.com any more than I trust somebody pretending to be news.ycombinator.com; validating that cert does nothing useful for me.
Thus it can be the eavesdropper, easy.
Even if you're being MiTMd by a criminal organization, you aren't also being listened to by the NSA.
