I don't think any really. The root that did the cross sign was already removed (not trusted) from the chrome and mozilla root stores before they did the cross sign.

There may be some scrutiny of Sectigo's part in this, however, they did revoke the cross-signed certs within 24 hours of acknowledging the issue: https://bugzilla.mozilla.org/show_bug.cgi?id=2083449#c13

"Sectigo has completed the revocation of the affected cross-signed CA Certificates. A new CRL and OCSP responses have been published and are making their way to our CDN edge nodes right now.

We will continue monitoring and evaluating this bug for further updates from Emudhra."

Maybe CAs should spend a few thousand CPU hours trying to crack submitted intermediates before actually signing them.