Hard disagree, especially that Windows has always demonstrated that its root certificates can be upgraded if necessary, even without other updates (security or non-security) and even Linux distributions can update root certificates effortlessly. It is Android's design to blame here (regardless of whether manufacturers should share blame here, which in my opinion they (especially Qualcomm) definitely should).

The locking the bootloader thing should be illegal, by international law, to prevent e-waste. It should not be legal anywhere on earth to fill the landfills with short-lived high-tech devices.