Who protects you when the packagers decide to trust a shady CA (adding it to the root store) because it's used by the distro's infra?

Is this supposed to be some kind of gotcha argument? Against what?