I don't know the details of this specific situation, but it's possible to have two signatures on an intermediate CA. One by the old Symantec root, and the other

I don't know the details of this specific situation, but it's possible to have two signatures on an intermediate CA. One by the old Symantec root, and the other by a trusted root. Up-to-date clients will ignore the Symantec chain and only follow the trusted chain. For example, Let's Encrypt maintains compatibility with old browsers by having IdenTrust (a widely trusted root) cross-sign their intermediate CAs.