Android itself (I.e. Google) maintain thier own list; they manage it well IMHO but made a catastrofically bad desision to never update it outside OS versions (they have fixed this in the next release).

In principle whoever is building the Android system can choose whatever roots they want. In practice the Android Project is a Google project, and follows Google's policies.

Also in practice, Google's policies strongly resemble Mozilla's. Mozilla's root programme is overseen by mozilla.dev.security.policy, a public group. So, to some extent the answer to "Who governs that list?" is you do, much as (if you live in a democracy) it's your fault that your government is terrible. You could work hard to improve things. But, you probably won't.