Sure, you could MITM still if all you do is that, as with anything it depends on what you are defending against.

If you are defending against clear text being discoverable, then bcrypt hashing with a unique salt on the client is good enough.

If you are trying to prevent MITM you can combine that salting with public/private key transmission of the bcrypt hash to the backend (effectively the same idea as pass keys without the downsides).

MITM just affects your service, and doesn't always matter depending on what the service is, for example, a recipe manager doesn't need to have bullet proof security.