In 2003 (or thereabouts) I was a paying user of an Apple music product. They deliberately broke the way that I used their product, then once someone found a workaround, they broke that, too.
I tried to be their customer, and they kicked me out for not using Windows or MacOS. Now I’m emotionally invested in not giving them any money, ever.
You can just issue new certificates one per year, and otherwise keep your personal root CA encrypted. If someone is into your system to the point they can get the key as you use it, there are bigger things to worry about than them impersonating your own services to you.