They have it. It’s called Xprotect. I’m surprised it hasn’t been used to remove the bad certs.

https://fullmetalmac.com/cybersecurity/macos-security/xprote...

XProtect removes malware, not certificates

what are the capabilities? presumably it could a apply a diff, patch or overwrite a file. in this case it's not even in the protected partition.