Do pip / certifi / node bundle their own trusted certificate authorities? Surely you should just be able to remove the compromised intermediate certificates from whatever store you're using and pip / certifi / node refer to the operating system's CA store and prevent that.

pip (and Python more broadly) rely on certifi for certificates, which bundles its own certificates. You have to explicitly point certifi to a different cert store if you don't want it to use bundled certs.