Being unable to install a custom root cert would break a bunch of shit.

Yeah but who would try to use commercial hardware as an attack vector?

It can have its small benefits to install custom (non-root) certs in Windows 10 to support old hardware,

Thanks to the folks at http://leshcatlabs.net/unifl-unified-leshcat-drivers/ i can put Windows 10 on old laptops with 'unsupported' old AMD and/or Intel gpu's.

When i was modifying my HTPC from Windows 8 to 10 i also experienced that annoying protection. I used the Cmedia BitPerfect drivers on my Windows 8 machine (https://code.google.com/archive/p/cmediadrivers/wikis/Bitper...) to have almost perfect DTS throughput, but couldn't use these on Windows 10 because not signed. The Leshcat people kindly provided me with a signed version.

It should be possible, but be like Chrome Extensions where there's an entirely different flow to install a non-WebStore extension. Though perhaps Chrome's doesn't provide enough warning...

Yes it is.