[user5994461]

To reply to your question. It's possible to install a CA without one's knowledge.

The battle update this week requested to run with admin rights, like a million of setup software. It didn't ask specifically "Allow setup.exe to install a system CA? Yes/No".

[mikestew]

Ah, thank you. And it’s the answer I suspected (use the admin rights of the installer), but apparently need to burn some points to get a confirmation.