> By default, all modern Android apps only trust CA system certificates, and on a normal device you cannot change those.

Sure you can. It's in a settings pane, Settings -> Security -> Encryption and Credentials -> Install a certificate.

MDM profiles can also install certificates.

There's pretty much zero possibility of this being removed as a feature as it is essential to a wide variety of corporate environments.