Why are some websites seemingly immune to self-signed certificate MitM attacks?
The short answer is HTTP Strict Transport Security
.


  When a web application issues HSTS Policy to user agents, conformant
  user agents behave as follows:
  
  
  Automatically turn any insecure links referencing the web application into secure links. (For instance,
  http://example.com/some/page/ will be modified to
  https://example.com/some/page/ before accessing the server.)
  If the security of the connection cannot be ensured (e.g. the server's TLS certificate is not trusted), show an error message and do
  not allow the user to access the web application.
  


(emphasis mine)

On websites that have it configured, many browsers will not let you add an exception for untrusted certificates.