The problem is the certificate can be re-added when you do an update (if the update included new root CA's). Thus it's usually safer to just mark the CA as untrusted.
I doubt root cert updates are an update to the entire set (at least that's what I would hope) - less chance of breaking something else in the process.