I'll simply explain what are these certificates and you'll get the point.
Suppose that you you visit your bank site, then your browser relies on digital certificates to ensure you are connected to the intended Web site only(for identity and security).
Who provides them? There are trusted 'Certification Authority' or CA from whom your banking site purchases their certificate to prove their authenticity and trustworthiness.
Now, that CA shouldn't issue the same certificate to any other party. If that happens, that party can pose as your bank and turn a fraudster!
Alternatively, the CA himself can be hacked and the certificate (intended for your bank) may become a property of the hacker also. It's misused then. That's one of the scenarios.
Root certificate is secondary here - When a device tries to validate a certificate, if it's not provided by any known trusted CA, the device client goes up the CA hierarchy (hierarchy of CAs on the internet) till the top (the Root Certificate) to validate.
So now you have the idea that if a ROOT Certificate (one thought to be the root, by your device) is a compromised one or fake one, it's a big inherent trouble!
(and that's what Zemana and others strive to inspect)