Think about it. If you try and put an unsigned certificate into the Trusted Root Certificate store, Windows erases it because it is not related to the existing trusted certificates, but what is stopping someone from removing all the Windows certificates and replacing them with their own? In this way you can make it so virtually any certificate would be accepted by the Trusted Root Certificate store. This seems like a large gaping security hole.
Not being an administrator is what prevents this from happening. It's not a security hole if you already own the machine.
Theoretically yes, you could do that with a lot of hassle, having in mind to establish your own "fake" trust chains. But what would you achieve? You would only get trust ON YOUR SERVER, nothing more: - outside clients will still use their own trust chains to verify any certs - your inside users are prone to you (as IT admin) mistakes, so you can put them in danger in many easier ways...but still, how could you compromise your own local users that way? By deploying hoax and phishing web sites inside your network? You can compromise them anyways :) - beside that, browsing and accessing other outside certs from your server would be almost impossible that way, as you would ruin all trust chains
So I see no security breach here, no gaps, nothing useful.
Not only is this not a theoretical 'gaping security hole' - it's entirely possible and part of how certificates work.
Organisations include their own trusted root certification providers all the time. Fiddler uses a similar method to what you describe to allow decryption and analysis. Devs do it manually, too.
Security over the OS is critical - if your OS is compromised it's game over regardless.