No, they are providing a service, LTS, that customers still want and pay for. Only once the customers realise its not a workable product and they want a rolling update product, with all the changes that implies, will this change.
That doesnt mean the key leaked - its likely in an HSM for example, but there is an API to get it to sign stuff. Access to use keys is less bad in many ways than leaking keys, but still pretty useful.
You can also reduce blast radius from breaches, and make systems more robust, rather than just trying to make zero mistakes. How bad breaches are and how well you can recover is also part of the outcome, just framing it as zero breaches or nothing is not that helpful, even though reducing breaches is important.
Could it? Where else in the world has this sort of control? Most countries have more lawn freedom I think, you might get people disapprove but there are no controls.
The Go and Rustls upgrades specifically block the intermediate certs because neither of these use the system revocation lists, I believe. Once you upgrade to a trust store without the root cert for the CA this will also solve the issue. Not sure about other ecosystems.
For some kinds of forecasting it doesn't need to be exactly accurate - eg say you are forecasting traffic for how to scale a load balancer, it can be a bit off it will just cost you a little and you can adjust after - a lot of feedback systems dont need full accuracy. You wouldnt use this to forecast whether to buy shares. It basically replaces various traditional curve fitting tools. If you need a really good forecast yes you are going to build a domain model. At least this is my understanding...