PKI has two elements: the technical protcols and the procedures we build around them.
In the technical realm, things are pretty clear: you got mechanism that allows you to decide what to trust, when under what condition and how to communicate (most) changes in that trust system (CRL, OCSP, etc.).
These technical elements do not, however, cover the procedures: how to we know that such and such root can be trusted ? As a user, usually because you trust (implicitly) the company that builds and maintains your root CA list (Microsoft, Mozilla, Google, Apple, etc). As an actor, because you review the way these roots have been validated or validate them yourself (for instance, if you're using private roots, it's important to conduct a proper investigation on how they are managed).
So, how does one know that an (intermediate or root) CA has been compromised ? It can be because you spot some improper use of that CA (for instance finding a leaf certificate that is signed by a certificate that doesn't have the right to sign keys) but it most likely is always because of some procedural element: someone did an audit and noticed an inappropriate usage of said certificate.
In the specific case you linked, the issue was really of that nature: the ANSSI did something that it really wasn't supposed to do (issue a certificate in name of one entity to another unrelated entity) and that is why its certificate was revoked by Google and Mozilla.
This highlight the problem with the whole public PKI system: there are too many actors that must follow too many rules that are not trivial to understand and even less easy to follow. And it takes only one of the actors to fail for the security of the whole system to crumble: the whole thing is incredibly brittle.