Keys in DNSSEC follow the same delegation of authority that the DNS itself uses, so the question you're asking here is essentially "why is DNS hierarchical".

If your computer runs a normal local resolver and goes through a compromised network, there's nothing DNSSEC does at all to help you. It's a server-to-server protocol; between stub resolvers and servers, the whole protocol collapses to a single "AD" bit in the header that says "trust this packet, your server really did all the signature validation". This is a silly design, and is the reason for things like DoH.

If you're running your own DNS server, attackers can't simply replace the DNS root key; there's a somewhat elaborate process for publishing new ones, which are stored in anchors usually on the filesystem of your DNS server. See Paul Wouters article here:

https://www.redhat.com/en/blog/what-you-need-know-about-firs...

In practice, you can ignore pretty much all of this, because DNSSEC is moribund and almost nobody uses it; in reality, the DNSSEC root private keys could land on Pastebin tomorrow and nothing would "break", and most tech company security teams wouldn't even need to be paged.