As long as they continue to support the surviving root cert, they are beholden to the root program and need to be accountable for this incident.

So far their responses to critical questions in the Bugzilla (https://bugzilla.mozilla.org/show_bug.cgi?id=2083449) have been rather weak and delayed.