So, presumably they put their badly-issued "real" public cert on the checkpoint (instead of making their own captive CA and root key/cert for that), and it would have just complained/not worked, normally, but since it was mistakenly issued as CA=YES, it worked, and no one cared. Then Google discovered it because of some Chrome users behind the checkpoint.

I guess incompetence is a decent explanation here, and probably the most likely, but also provides a very convenient explanation if you wanted to hide something more sinister.