The backdated certificates that have already been found are explicitly being added to OneCRL, which is to say that they are explicitly distrusted independent of what the CRL/OSCP responder of WoSign and StartCom say.

So some portion of Firefox users will be protected from them. Better than nothing I guess.

IIRC they were revoked in the course of the investigation (somewhere in the last two months).

That being said, the risky bit is that they actually signed those SHA-1 certificates in the first place - a certificate that could be specially crafted to "collide" with one for a site an attacker wants to impersonate. It's not really all that important whether they're revoked (though there's nothing wrong with revoking them just in case).

As for CAs being the weak point, luckily we're going to be living in a mandatory Certificate Transparency world in the not-so-far future.

IDK, I'm worried this is an example of what that will look like: since the CAs are the actual stakeholders, the default question is going to be "what can we do to make this CA trustworthy again?" rather than "how can we make sure this CA never has another cert trusted again?"