How can you protect against a man-in-the-middle forging a TLS Client Hello that offers insecure algorithms?

According to PAN-OS documentation for "Traceability and Control of Post-Quantum Cryptography",

Traffic encrypted by PQC [post-quantum computing] or hybrid PQC algorithms cannot be decrypted yet, making these algorithms vulnerabl… Continue reading How can you protect against a man-in-the-middle forging a TLS Client Hello that offers insecure algorithms?