As far as I understand it this has very little impact on the security of OpenSSL and can only be abused by someone with access to a signing system (and then you

As far as I understand it this has very little impact on the security of OpenSSL and can only be abused by someone with access to a signing system (and then you have more problems anyway). What happens is that during the signing phase the certificate up the chain is read and checked, then during the generation this root certificate can be swapped out form underneath the process, and the generation proceeds as if nothing happened. This means that the newly inserted root certificate is inserted into the chain of trust, while it was not explicitly added.