Yep, but it was an easy zero-touch MITM vector for billions of devices that's only now being closed down

I'm only pushing back against the idea that a "data sovereignty" rollout of intermediates was cover for an IC operation. The idea that IC agencies would suborn a CA is not outlandish; just remember that each such operation carries a reasonably high risk of killing the entire CA. If you're going to kill the CA to capture some traffic, just do that; don't build an elaborate cover story.