> how many of these devices will have the compromised CA root certificate in place?

I have two Google devices at home and both are compromised still. If Google can't handle pushing out a quick cert chain update, then I truly doubt other manufacturers can.

I'm rather surprised google doesn't require cert pinning for all connections to any google server....