The root programs all allow for technical and procedural controls to meet the this criteria. There are technical controls beyond name constraints as well.
Again GlobalSign's policies do not allow the use of certificates that chain to our roots to be used for MiTM purposes (or other malicious use cases for that matter) and we have controls in place that protect against such things occurring.