The .cn TLD is can be MITMed by the Chinese government, yes. That's why you need to host your chinese-dissident page in a TLD of any country that hates China (ie, almost any of them). Same for a site that reveals wrongdoings of the NSA. Any point other than ICANN can be avoided by simply chosing a different TLD, and ICANN itself can be secured by pinning TLD keys.
This goes in sharp contrast with the CA cartel model, where you need to trust the sum (rather than alternative) of 400+ entities, some of which are known to be actively engaged in MITM, like CNNIC or Etisalat.