Yep, it's a long tail. Anything that ships it's own CA bundle will ignore whatever you fix at the OS level. Those bundles are generally root-only and don't have revocation checking, so they can't block a bad intermediate cert.

The fix can only come from the tool shipping an updated bundle, or if there's some way you can point it at the OS store once that's updated.