It's just an organizational decision. CNNIC is super trustworthy to a lot of people. It's so many people, in fact, that they can't possibly verify all of the sites these people want to visit. So instead of burdening CNNIC with verifying the identity of every single site that wants a cert that their users will trust, CNNIC will just verify some other CAs as being trustworthy enough to do the job.

Personally, I think I should trust the hardware or OS manufacturer to pick exactly who is trustworthy enough to certify websites, since I'm trusting them that my computer is doing what it looks like it's doing anyway.