An organisation (a school in this example) requires connecting personal devices to install root CA certs to allow SSL inspection to occur. Whether is this ethical or unethical is another issue - in the context of verifying that the content accessed is appropriate for a school, SSL inspection is probably overkill and begs a question as to why SSL inspection is actually implemented on the network.
The organisation's administration staff do not properly understand the security issues present with this setup and thus the issues cannot be communicated back to the network administration staff.
Guests are encouraged to have their device join the network, which then the root CA certificates are required to be installed and accepted.
The root CA certificates were issued for 10 years from 2016 - a recent upgrade to the network required them to be re-issued and re-installed, meaning old root CA certificates are still installed on hundreds, if not thousands of machines.
Clients (students) - hundreds - leave every year and their personal devices will still have the root CA certificates installed, with no instruction provided by the school to remove them
Is this quite significant? or should it all be ignored - how can you express the issues associated to computer illiterate administration staff