Can you explain what first principles you mean? /etc/ssl/cert.pem has been a fairly standard convention on BSDs, and Linux distros usually have an equivalent somewhere too, like for example /etc/ssl/certs/ca-certificates.crt.

I don't blame Apple for overlooking it when they have their own security stack that all their own apps use, which already responded to the incident within two hours of the revocation. As another commenter pointed out, Terminal commands probably just weren't a priority of their threat model. I do hope they fix that, but mentioning their market cap is not gonna help here.