alt Hacker NewsIt doesn't have to, you can set X509 name constraints which say "the CA may only issue/may not issue certificates for these Subjects," or you can set CAA in DNS, for example.
(Of course, the former isn't really intended to constrain trusted Root CAs, moreso internal PKIs. But it is an option people should know about!)
To my knowledge, name constraints are very rare in actual use, and a bunch of implementations don't even support them. Am I wrong?