This sounds like a serious issue, and I wouldn't be surprised if news will come out soon about an app that allows for a massive security breach because it didn't use the root store correctly.

S/MIME and HTTPS are quite different types of services, the former still usually relying on long-lived certificates whilst the latter is moving to shorter and shorter certificate validity, lessening the impact of a breach. Using S/MIME certificates to validate TLS might even allow a website to use the certificate of some random email address in your company to do a man-in-the-middle attack on your certificate, if the app's implementation was written badly enough.

--

Offtopic: speaking of root stores and Mozilla, I'm still miffed about Firefox's decisions about the subject on Android. They removed the old root certificate management/installation pages, put a switch to enable the system's user certificate store in about:config and then removed the ability to use about:config from the stable release of Firefox for Android.

I've seen a commit message saying that they moved the setting to allow the certificates the user explicitly installed on their system to work inside Firefox into a secret developer menu. I found that thread because I was looking into why my phone would randomly reset the about:config setting every day (because of a bug? because of the change? who even knows).

My intranet websites work on pretty much every browser other than Firefox on my phone. It's really annoying.