There is no approval process, no central authority. If you want your CA in OS X, you talk to Apple, if you want it in Windows, you talk to Microsoft. If you want it in Firefox, you talk to Mozilla.
No browser wants to be the one which doesn't work with someone, somewhere's bank, so once you're on one list, you tend to get added to all of them; and it becomes nigh-on impossible for marketing reasons to remove anyone from the list ever.
15 years later, browsers have 80 CAs and 200 certificates built-in.
I'm not sure having a central authority would be practical, but the approval process and audits need to be more thorough to find the type of security problems that DigiNotar and Comodo had.