They can be enabled by policy. An enterprise will usually have a policy installing it's custom ca

https://www.chromium.org/Home/chromium-security/crlsets/

See here for some of the why: https://www.imperialviolet.org/2012/02/05/crlsets.html