The researcher in question has publicly stated[0] that he wanted to try Google's paranoid_crypto tool[1], so he ran it on some roots as a quick proof-of-concept, and the first thing that happened was that it detected these intermediates. He also states he's been running a lot of certificate linters so this was just the next logical step I guess.

[0]: https://groups.google.com/a/mozilla.org/g/dev-security-polic...

[1]: https://github.com/google/paranoid_crypto