How is STS more secure than regular DH
Note the first paragraph of the page:


  In public-key cryptography, the Station-to-Station (STS) protocol is a cryptographic key agreement scheme. The protocol is based on classic Diffie–Hellman, and provides mutual key and entity authentication. Unlike the classic Diffie–Hellman, which is not secure against a man-in-the-middle attack, this protocol assumes that the parties have signature keys, which are used to sign messages, thereby providing security against man-in-the-middle attacks.


It's worth mentioning that this is to be expected --- the notion of "identity" in cryptography is different than in real life, and is probably best thought of as "knows the private key corresponding to some public key".
Given this, users must have a way to share public keys free from adversarial behavior (otherwise an attack like you describe can easily go through).
This is the purpose of Certificate Authorities in the modern web, and while they're a cryptographically inelegant solution (they're explicitly a trusted third party, where much of cryptography can be phrased as removing trusted third parties), removing them seems difficult.

Note that this protocol explicitly mentions authentication, while DH doesn't.
This is what enables you to MiTM DH.
Of course, in practice people use a separate digital signature scheme with DH key exchange for authentication --- so what's the difference?

Something that should become fairly clear rather early in cryptography is that how you combine primitives matters.
ECB mode can use secure primitives but still be insecure.
Just like that, DH can use a secure signature scheme and still be insecure.
This was the basis of the Logjam attack in 2015, where you could MiTM TLS 1.2 via (among other things) taking advantage of poor use of signing in the DH key exchange.