It’s not an excuse but an explanation: there are separate stacks owned by different teams and they haven’t been forced to collaborate. If you use an internal CA you’ve already had to deal with the easier additive version of this problem because that fails in an obvious, less harmful manner than quietly accepting something which needed to fail.

Agreed. Why does macOS ship with two copies of the trust store? Shouldn't the process to update the primary store automatically derive the other?