One theory is that, ideally, the end-user should manage his own store of trusted root CA, making an informed decision based on the published Certification Practice Statements by existing CA.
Theory and practice match only in theory, though. It is not surprising that most users cannot and will not handle such a management process, if only because it relies on highly technical concepts (not only cryptographic concepts, but also and most importantly legal concepts). Therefore, OS and browser vendors take it upon themselves to decide on a list of "default root CA" that they will put in their browsers, and will be trusted by the overwhelming majority of deployed clients. These vendors do that as part of relatively complex procedures with heavy requirements on the CA, e.g. insurance and detailed procedures in force at the CA side. (See this answer.)
Right now, CAcert is a "wannabe" CA which tries to become a "trusted CA by default", but has not yet reached wide acceptance by OS/browser vendors. Part of the problem is that procedural requirements for a secure CA have a strong financial counterpart: the physical security requirements are not cheap (you won't put a serious CA "in the cloud"; you need secured premises), and the CA must demonstrate that it has the means to keep on working for a long time, or at least to do a "clean closure" in case of cessation of activity. Money is the key. The CAcert stance of "let's give away free certificates" does not help in making enough money for that.