Being able to trust the OS is a huge advantage, though, and they built the rapid response mechanism to handle those updates:

https://support.apple.com/en-us/102657

The big question is why they’re not using it for things like this, where a tiny layered file system update would benefit almost all of their users immediately.

but the volume with these certs isn't protected. you can edit the files with vim. i'm curious what the holdup is.