If there’s no custom root certificate - the configuration on production devices - the root certificate is never checked on macOS 12.3.1!
What a find!!
They Just Let Anyone Sign One Of These (MacOS CoreTrust Root Certificates)
Posted on 2022-10-09: https://worthdoingbadly.com/coretrust/