because eventually, somewhere in the API there must be a way to actually add that cert. The API that's being called from windows internally when you press the "OK" button on the warning that's normally shown.
And even if there was no API or if you do not manage to find its location: At some point, the certificate needs to be stored somewhere. So you just put it there and be done with it.
You can try and fight this using stuff like OSX' new rootless mode, by making a second class of binaries who are more trusted than others, but even then there will always be ways around it and the backlash would be considerable too (there were some very nasty comments about the introduction of the OSX rootless mode, even though it's turnoff-able).
The only way to prevent this from ever happening is to pre-approve every single app you want running on your platform, but, honestly, that's not a platform I would want to use (not that I want to use Windows anyways)
The rootless mood was only a huge pain in the ass because everyone was used to pathing usr/local/bin and brew, probably one of the most popular package managers, relies on a rootful env. Brew was definitely playing with fire and even though it was tricky getting shit to work again, I for one am glad they opted to go rootless at the behest of user convenience. Sometimes foul medicine is the best kind.
