As if, someone with such access would probably know better than to burn it by indiscriminately using it against connections with pinned certs.

You aren't claiming that they couldn't compromise a CA, are you? That's pretty much the only thing that would make such an assumption unreasonable.