And when they find evidence of a CA misbehaving they revoke them, as here, they don’t go to the EU and say “hey we think you need to re audit this company” and then wait a few months/years while the business continues to pay the EU to remain in the root stores.
For example: https://www.techtarget.com/searchsecurity/news/252436120/230...
Firefox seems to include root CA from the governments of: Hong Kong (so China?), Spain, Turkey, Tunisia, Netherlands.