What they're saying is that is that if {{malicious user}} receives an ip cert from {{malicious-enabling root CA}} trusted by {{unwise OS/browser vendor}}, then

What they're saying is that is that if {{malicious user}} receives an ip cert from {{malicious-enabling root CA}} trusted by {{unwise OS/browser vendor}}, then infrastructure-{aided,involved} attacks become easier. The intractable and difficult root (pun unintended) problem is OS/browsers/CA root cert list providers must delegate trust carefully to legit CAs while continually auditing they're not issuing garbage certs to entities that can't prove they own the subject(s) they're covering. CA = Certifying Authority is the issuer of certs that make https:// work, but isn't limited to uses of just the web. S/MIME email, some software signatures, and more.