So if nobody can steal anything, what's the problem?
What do you mean? The MITM spoofing the node gets to run away with all of the BTC that the pub took that evening.
How? It can't get the bar's private keys, and it can't change the bar's receiving addresses. So how is it supposed to get hold of those coins?