If someone has the private key to a trusted root certificate, they can forge the certificates for any TLS connections you make.

The countermeasure is certificate pinning, but that is typically implemented only for a handful of sites; e.g. Google with Chrome.