IIRC they were revoked in the course of the investigation (somewhere in the last two months). That being said, the risky bit is that they actually signed those

IIRC they were revoked in the course of the investigation (somewhere in the last two months). That being said, the risky bit is that they actually signed those SHA-1 certificates in the first place - a certificate that could be specially crafted to "collide" with one for a site an attacker wants to impersonate. It's not really all that important whether they're revoked (though there's nothing wrong with revoking them just in case). As for CAs being the weak point, luckily we're going to be living in a mandatory Certificate Transparency world in the not-so-far future.