Why are they supposedly vulnerable? If you register your custom CA as trustworthy + keep the important files offline, then you're just as well (or badly) off as

Why are they supposedly vulnerable? If you register your custom CA as trustworthy + keep the important files offline, then you're just as well (or badly) off as with a regular certificate.