That's when the apps start embedding(pinning) certificates and completely ignoring any additional root certs you might want them to accept from the OS.
That's when you start injecting your own certificate into the certificate verification APIs... one of the amazing powers you get when you're root and actually have full control of your device, no wonder it scares big (ad)tech for users to have that power.
