They are pre-placed on an Android phone by Google, as if every user “may” need them at some point. They are from entities all over the world.
The FCC should make the practice illegal.
Android can change to operate such that the user is asked if they want to load a certain certificate, when and if the user’s use of the phone encounters some cause to ask for it.
The user should have the clear option of saying no, informed only that saying no may affect just something they are trying to do at the moment, and nothing more.
Every modern computer system comes with a library of “trusted certificates,” which are the roots of trust hierarchies which guarantee the identity of every entity on the network. I don’t think you’d like it very much if every website you hit popped up a window with arcane details of their root certificate and asked you if you wanted to trust it or not, but that’s what you’d have to do if your device didn’t have a trusted certificate set pre-installed on it.