Systems that depend on the removed roots may need their certificates replaced, and disconnected machines must take the update manually.
Software that depends on web PKI but cannot filter intermediates stays exposed until its updates arrive.
Browsers and operating systems now reject the affected intermediates, but some software with its own trust store may keep accepting them until it is patched.