Why should podunk CAs be trusted by default to sign google.com when that's not their intended purpose?

Because managing a listing of each domain and the set of the CAs that have the "purpose" to sign certificates for that domain is not very practical. The problem is that there are more than 20 domains.