Say there is an Android APK. You want to sniff the traffic to the private API. So you decompile it, find the cert, then replace it with fiddler's or burp's or charles proxy's, recompile it then run it, using one of the above listed proxies to sniff the traffic.
Is it really that simple? I easily found a text file titled "pubcert_prod"(along with pubcert_dev) in a top 10 worldwide app by ctrl+f'ing the decompiled apk.
It would be extremely trivial to write an automated tool that decompiles the app, searches contents for cert file extensions and/or greps for -----BEGIN PUBLIC KEY/CERTIFICATE----- and use openssl to generate a new cert and replace it which can then be used to sniff the ssl pinned traffic.