Today I was checking out macOS security and privacy guide, and when I looked at my keychain, I was surprised to find Startcom CA and Symantec CA trusted by default. Isn't this supposed to be vulnerable to MITM?
Apple's reaction to the StartCom irregularities is:
Apple products will block certificates from (...) StartCom root CAs if the 'Not Before' date is on or after 1 Dec 2016 00:00:00 GMT/UTC. (Source)
So to verify certificates that have a 'Not Before' date prior to the one mentioned above, they need the StartCom certificate.
With regard to Symantec certificate authorities they've decided on the following timeline:
Starting August 1, 2018: Partial distrust of Symantec CAs
Later date: Full distrust of Symantec CAs
I guess the 'later date' hasn't arrived yet which is why they still need the Symantec certificates.