It was probably meant to prevent malware from adding their own CAs. In practice, though, it even stopped Windows from keeping its official CA list up to date.
In October 2021, the root certificate used by Let's Encrypt expired. All existing certs were cross-signed by another broadly supported (but more recently included) CA, so this should have been a non-issue on any reasonably up-to-date device. Uh oh, a lot of South Korean PCs had had their CA lists frozen for several years. Suddenly, random people all over the country were unable to connect to websites using Let's Encrypt despite being on the latest version of Windows 10. It was nearly impossible for ordinary users to track down the offending program and uninstall it, and there was no guarantee that the CA list would be restored upon uninstallation. A lot of website owners just switched to ZeroSSL or some other CA because of this clusterfsck.