> My company might have 4 domains on different TLDs

Your CA would have a root cert per TLD. Alternatively, we get rid of non-cc TLD (and leave ccTLD only for truly geography-bound organizations, like governments).

Wouldn't that be almost 2,000 root CAs?

Also if it's the same CA operating a bunch of different roots for different TLDs, they're likely to just make the same mistake that impacts them all. Sadly, I can't see anything like this working.