what are the capabilities? presumably it could a apply a diff, patch or overwrite a file. in this case it's not even in the protected partition.

My bet is the XProtect update mechanism could be used to update the certs.pem file.