This incident somehow exposes another previously overlooked issue. I just notice that so many softwares vendor their own version of CA store for no particular reason [1][2]. It is relatively easy to patch system CA bundles. It would be quite challenging to patch every binary that embedded their own CA. As such, many systems will remain vulnerable for quite some times.
[1] https://github.com/NixOS/nixpkgs/issues/576475
[2] https://github.com/zimbatm/nix-cacert-scan