According to the link you posted, there are intermediate CAs. Those could be revoked and effectively revoke all the end entity certificates.
They're essentially on-line root certificates because they serve most of the function that such roots would serve if they were allowed. There aren't a bunch more available to replace them, so this means recovery now requires a key ceremony, figure on a week to a month to arrange that.
Whereas if you're able to "just" revoke 10 million end entity certificates you can recover immediately.