Every Root Certificate programs have different requirements for including an Authority in their root store, that is why there's no single truth, because they're all truth according to their respective root program's requirements.
The root program's requirements in all major browsers are more or less aligned with the CA/B Forum Baseline Requirements, but each root program are allowed to add more requirements, which leads to different browsers shipping with slightly different set of root certificates.
Whom do you trust?
Trust is a complicated thing, it's not binary. The fact that I trust Mozilla's Root Certificate program for verifying certificates for web servers during my daily browsing, does not necessarily mean that I trust them for code signing of my company's internal code signing authority for software that we develop, run, and deploy. And neither does the fact that I trust my internal code signing authority for signing these software means that I trust them to certify web sites that I visit using my work computer.
If trust is really important to you, you will want to verify yourself which part of the root program's requirement matches your own requirements, and which ones of your requirements are not satisfied and for which you may need to do separate verifications.
Note that most public Certificate Authority root program are concerned about identity, rather than the ethics, competence, or even legality of the business practice of the organizations they sign for.