[floatboth]

Starting with Android 10, Google can push updates to lots of system components (media codecs, android frameworks, tzdata, …) https://android-developers.googleblog.com/2019/05/fresher-os...

But those on older versions are screwed. It's really a major fuck-up that Google didn't do this for root certs since the beginning of Android.