It is in-scope for a security update, and they say one will be coming. They just couldn’t modify cert.pem without a security update like they did for their own SSL APIs. Hopefully a security update will be coming soon.

There is justification for controlling the scope of security updates. Apple practices incredible defense in depth. This is one of the reasons they can claim such privacy guarantees compared to other vendors. But, I agree that they should have been able to update this file automatically, and hope they will add that capability for the next time something like this happens.