Anyone can generate a root certificate and then ask you to install it. Large corps do it all the time for internal use. The “trick” is that the browsers will block the installation of this one in particular.
6 Likes