The 'all or nothing' take on security is a very childish or naive point of view.

No security system is invulnerable, and even the slightest inconvenience will prevent a certain percent of behavior.

In light of those two facts, you must speak about specific threats and attacks if you want to say anything about security.

For example: Compromised root CAs have not been found to be used by criminal gangs in bank phishing schemes. Therefore, they seem to provide about the right level of security for that threat.

Compromised CAs have been strongly implicated in government attacks, so they don't provide an adequate level of security in that context.

This doesn't mean they're beyond repair. They work for certain tasks in certain contexts, like your front door, or a safe, or a password, or a security guard.