What certificate lifetimes are on these CA certificates you're issuing without critical name constraints?

Will you reissue them all (for free) once you decide to start marking new ones critical? Will you require all such entities get reissued certs? Can you contractually require that they destroy the old certificates?

Then there's the matter of how problematic OCSP is; even if you revoke the old ones, it may not matter.