From RFC7469: "user agents (UAs) will require that the host presents a certificate chain including at least one Subject Public Key Info structure whose fingerp

From RFC7469: "user agents (UAs) will require that the host presents a certificate chain including at least one Subject Public Key Info structure whose fingerprint matches one of the pinned fingerprints for that host." This makes it easier to deploy. If an org repeatedly gets their certs from a single CA they can just pin that CA. It does of course open you up to being compromised if anyone compromises that CA. But, like you said it's a big improvement over nothing.