«Worryingly, it’s very easy to extract and use the encryption key run by Komodia, largely because the password to access all different versions of the certificate is “komodia”.»

No, the problem is that big subsets of affected systems share the same root certificate and private key. How or whether that private key itself is encrypted is less of an issue.