If you pin to a root CA you're vulnerable to MITM if an intermediate CA that has the root in its chain of trust is compromised. Because that compromised CA woul

If you pin to a root CA you're vulnerable to MITM if an intermediate CA that has the root in its chain of trust is compromised. Because that compromised CA would be able to sign a cert for an arbitrary domain while still satisfying your pinning directives. By pinning to a public key you're saying "is this public key in this certificate's chain of trust?". Pinning to a root you have the most flexibility but the least amount of protection against MITM.