Certificate trust bundles contain several hundred trusted certs that all can sign any cert for any name they want.
Your system contains at least four different of these bundles used by different libraries and languages, while other frameworks hardcode their own.
Outside of the browsers, absolutely nobody checks CRLs, OCSP (stapled or not), or CT logs.
Selectively distrusting intermediates (as Go did) doesn't scale and is not practical for most deployments.
So yeah, happy Tuesday.
