This is how the public certificate authority system is set up. The client vendors (Google, Microsoft, Apple, Mozilla) choose what the rules are for trusting a Certificate Authority and which ones meet the requirements. These "root programs" are the only thing that prevents rogue/incompetent CAs from mis-issuing certificates on a regular basis.

Since the CA business model is based on selling digital signatures that meet specific requirements, the threat of those certificates not working as advertised is compelling.

On the other hand, the client vendors can't go overboard with requirements on existing "too big too fail" CAs because the alternative is having large portions of the Internet stop working in their products due to untrusted certificates.

Edited to add: Google doesn't run its own root program, they use the OS root store, which will be from Apple, Microsoft, or Mozilla (most Linux distros use the Mozilla list). This means that the requirements from Google are in addition to those of the OS that is being used.