Does this mean it is impossible to add new trusted certificate issuers
forever? Is it impossible for one to start his or her own root CA
without the consent of computer manaufacturers?
A new CA can be created and have its certs added to the trusted list with cooperation from manufacturers. This could be the computer manufacturer, the OS manufacturer or the browser manufacturer. For example the letsencrypt.org initiative would require browsers to have the cert added in the trusted list (which will be done).
It is also possible for a CA to be removed from a trusted list. This has happened recently.
Just to clarify, as other posters mentioned a user can always make their own certs and trust them. This makes them a CA but this is not a good idea as it defeats the purpose of a CA (a third party that verifies the legitimacy of a certificate). These days there are projects like letsencrypt that hope to make it easy and very cheap for people to get access to certs for their domains that are trusted by manufacturers. Truly a sign of the times!
Also, what is stopping an attacker from simply installing "trusted"
certificates in people's computers?
Any user with admin privileges can add a trusted cert on a system. On top of that for browsers any user can just tell their browser to always trust a cert.
Dell did this recently by preinstalling a cert they created themselves, and accidentally including the private key with it.