It's basically an additional policy on top your OS's policy, while waiting for the stores to update, it protects the users.

If you don't bundle certificates, users will report that your builtin https client doesn't work in production (usually in docker)

It's probably about power. Certs control is getting higher value, so control over this policy means more negotiation power with whatever states (governments) need from platforms.

It's easy to imagine something like: "give us some grant taxpayers money and we'll add your cert to our trusted list/remove theirs cert/disable cert when run on this hardware/etc."

Indeed. But the Java keystore and the Firefox/Chrome/VSCode NSSDB and whatever Python is shipping this week aren't really better.

I wonder what's so annoying about OS certs.

What about it makes it so interesting?