I have seen multiple mobile applications that are pinning Global Root CA's instead of intermediate/leaf certificates. Doesn't this expose to the same risk as not having certificate pinning at all?
Considering the classic coffee shop attack scenario where the owner of the network has a certificate issued for his domain (
*.evilcoffee.com signed by DigiCert)
Now if the mobile application is trusting any certificate issued by Digicert then you can effectively MiTM? Am I missing something?