Comment by cmeacham98

Ubuntu has never seemed to take security particularly seriously.

So yes shipping a CA known to have intentionally issued false certificates is very on-brand for them.