So... Think of it like this. All of us have tried to shield users from having to develop or maintain their own trust networks. It's a hell of a lot of work. And it isn't sexy. These CA's are basically that implementation. They have been programmed in by default on most devices to be trusted, and changing that status after the fact is very hard.
The reason someone would want to to be able to issue one of these certs is it essentially allows them to eavesdrop on normally unreadable connection data because the device thinks the system in the middle is actually a trustworthy endpoint, and not a malicious TLS terminating proxy.
No one whose devices are by default trusting that CA now have any guarantee of confidentiality on any connection to a system presenting those issued certs.