There are definitely limitations in GNU/Linux root stores. E.g. to my knowledge it's impossible to distinguish between the root coming from the distro vs coming

There are definitely limitations in GNU/Linux root stores. E.g. to my knowledge it's impossible to distinguish between the root coming from the distro vs coming from a custom configuration, e.g. for corporate MITM proxies. So you can't e.g. require SCTs to be present for former but not require them for latter, like how Chrome does it for example. Also, is this additional information even published by Mozilla in a standardized format or if it's just put somewhere into Firefox source code? Also note that, given how Firefox doesn't implement SCT requirements, TrustCor could also just back-time certificates. So Firefox has similar vulnerability properties as users of distros that haven't removed TrustCor as a CA. So ideally you would also make it possible to distinguish between OS provided and custom configured certificates, to allow libraries to check for SCTs at all. Otherwise you haven't gained much from the additional information of limiting a CAs ability to issue new certificates.