What's an example?

We're in an era where browsers have forced certificate transparency and removed major vendor CAs when they've issued certificates in violation of the browsers' requirements.

The concern about bad/sketchy CAs in the list feels dated.

Look at the list of state actors in your certificates bundle, for a start