The Global Root is the owner of the computer.
They decide which roots are trusted - or in practice, they accept the vendor's judgement, and possibly add a few of their own.
But they can also remove items from the vendor list - many admins including me dropped diginotar for example even though MS retained them.
If on a network, your admins (perhaps this is you since you are reading S.SE) may also exercise their own judgement. Do I want my users trusting a Brazilian or Ukrainian CA? They might be fine but a) how do I know and b) why are my users on a Ukrainian or Brazilian website for work purposes anyway? Do we ever do business in those countries?
The ultimate controller is the administrator of the computer, not the World Government, not Microsoft, Google, the FireFox Commissariat or anyone else.