Honestly even if they were issuing certificates for much longer than they were supposed to, that is a way lower level of risk than "everybody in the world absolute-trusted a CA certificate that turned out to have a 256-bit private key crackable in seconds".