The situation is even worse than I thought.

They hold intermediate certificates issued by TWO different root CAs, neither of which they operate.

So two separate entities didn't bother to read their certificate policy or inspect their operations. Have we not learned anything from past mistakes?

Roots should be responsible for all their sub-CAs, full stop. If they don't trust them enough to accept that responsibility, then the system is broken.