Of course, if your CA is taken over, you are in big trouble. However, the attack vector here is much lower given you can have this on a local machine which is

Of course, if your CA is taken over, you are in big trouble. However, the attack vector here is much lower given you can have this on a local machine which is not even connected to a network if you like. The single point of failure for central management solutions is in having them as a running service - if that goes down, you are in trouble. And that is far more likely than your CA becoming compromised somehow. Also in practice, you can also run two or more CAs (we do that), so you can deprecate a full CA if the need arises.