I doubt these CA can write insurance contracts themselves without being a regulated insurance company so they must legally have an external insurance. I would be curious to know how much they are paying on this contract.

The insurance bit is forced selling of an unwanted product. I am sure that 99% of certificate buyers do not need more insurance from their certificate provider than they need it from their hosting company, or the developers of Apache and OpenSSL.

Insurance is for if someone suffers losses because a valid certificate was issued to someone it shouldn't have been.