You also need to block access to the approved CT list until it fails open after 70 days.

This is assuming the CT logs no longer issue SCTs for these CAs. If they do then you just need to the CT dance and publish that certificate there.

Of course this assumes the app/device isn't using certificate pinning.

With the speed of vibe coding.. I'd expect the "Reverse Engineer Anything" folks to come out with a "Man in the Middle Anything" app by lunch