It's unlikely that they'll suffer any consequences. The CA death penalty (i.e. root removal) is usually only used in cases of massive breaches, like in the case

It's unlikely that they'll suffer any consequences. The CA death penalty (i.e. root removal) is usually only used in cases of massive breaches, like in the case of DigiNotar. Sometimes, root programs force CAs to adopt things like Certificate Transparency or limit CAs to certain TLDs as a result (i.e. a CA that primarily issues certificates for a specific country might be name-constrained to that ccTLD to minimize the risk for other TLDs), but that wouldn't apply here as StartCom already uses Certificate Transparency and they don't really have a "primary" ccTLD they issue for.