> The crux is that previously any user could modify these certs directly, even on vanilla OS images from Google themselves, without installing any tools at all - just by writing to disk - and that's both widely used and included in the setup guides for lots & lots of tools.
"Just by writing to disk" omits the part where you needed to unlock the bootloader (wiping data), flash a custom recovery, install a superuser implementation and remount /system as writable (or used an overlay do fake it). The only thing that seems to be changing is where and how these certs are stored, so the procedure will be exactly the same apart from the last step, which was never the hard part. By the time you set up a phone for root access, needing one extra app or overlay to add CAs is barely an inconvenience.
No - the system cert installation works out of the box on Google's own official emulators, for both AOSP & 'Play Services' editions (but not Play Store). Ditto for Genymotion, Bluestacks, etc.
Zero root setup required in those cases, until now. Create the emulator, adb shell, su, mount tmpfs, write your CA certificates.
You can script it and do the whole process in <1 second on a fresh device.
Emulators are a whole different story, I didn't realise that's what you were talking about. But emulators are a very niche use-case and they're already running modified images, so they could easily include a way to write certs. The most important (at least from my perspective) uses of custom CAs are done on real devices though, which have always needed a lot of work to modify, so little changes there.
"Just by writing to disk" omits the part where you needed to unlock the bootloader (wiping data), flash a custom recovery, install a superuser implementation and remount /system as writable (or used an overlay do fake it). The only thing that seems to be changing is where and how these certs are stored, so the procedure will be exactly the same apart from the last step, which was never the hard part. By the time you set up a phone for root access, needing one extra app or overlay to add CAs is barely an inconvenience.