I think what's missing here is that TrustCor has no "right" to be included as a root CA. The question to ask is: is it in the interest of the browser's users.

I think what's missing here is that TrustCor has no "right" to be included as a root CA. The question to ask is: is it in the interest of the browser's users. TrustCor is some (smallish) risk for basically no gain, so the conclusion is is to remove it as a CA. This sucks for TrustCor. They may have done nothing wrong. That doesn't matter.