They have it. It’s called Xprotect. I’m surprised it hasn’t been used to remove the bad certs.

https://fullmetalmac.com/cybersecurity/macos-security/xprote...