Question for people who know about this: why do we have hundreds of root certificate authorities, when a vulnerability on a single one can break encryption?

Wouldn't it make more sense to have 5 or so that can be more closely monitored, so something like the eMudhra certificates would probably be found before the certificates are deployed?