Some companies do a man-in-the-middle attack on every TLS connection, so they can scan every connection for security stuff. They do so by terminating the TLS connection, scanning it for malicious content and re-encrypting it via TLS with a certificate that is not globally trusted.

If the root CA for the man-in-the-middle attack is added to the trusted root CAs of the operating system of our end