While a man-in-the-middle has significant power over the traffic flowing through it, CA lists are usually very well protected. A browser (etc.) does not consult anyone about the CA's it trusts. That list is part of the OS, or software package, and is updated through the normal OS/software update processes. (Windows has a common system truststore, but applications can bring along their own -- java and mozilla being common DIY'ers. The same is true of almost every other OS.)
For example, if you were still using Windows XP, the recent expiration of the root CA used by Let's Encrypt required local corrective actions -- remove the old CA, import the new CA -- because XP no longer gets updates from Microsoft. Newer versions of Windows already had an updated truststore if automatic updates were being installed.