Yes, one can remove certificates from a "trust store" in a folder (in practice, usually a "bundle" maintained by a browser vendor, or something derived therefrom)

But how does the www user remove a certificate that's compiled into a popular browser

The popular browsers, maintained by companies invested in internet surveillance advertising, is so large and complex that in practice few will edit and compile it themselves. Not only is certificate removal impractical but user-signed certificates outside the browser will usually trigger multiple warnings, even requiring users to type shibboleths to be detected by keyloggers

This "Web PKI" system presumes no www user can _ever_ trust themselves to make trust decisions. It's presumed that this is _never_ an option for _any_ user, in any situation