Apps can do this by presenting a configuration profile to the user. This requires entering the passcode and a few steps - it’s not something they can do silently.
Also, after installing a certificate the user needs to explicitly go into Settings sub menus and toggle trust for that certificate.