The real issue here is that if you don't manage Chrome installs, the MITM potential probably shifts to userland like Firefox...

I don't care about managing an additional cert store, and most likely, they'll add a policy for businesses to use the machine store (like Firefox). https://twitter.com/campuscodi/status/1322576899823075331

There are several ways to manage settings for both Firefox and Chrome, and in a business environment, you want to apply policies instead of letting users put unmanaged browsers in userland.

I'd consider controlling allowed extensions and other security sensitive settings too.

Swift has a nice thread over here with lots of great feedback about managing the Chrome browser.

The ADMX's provided in the Chrome Enterprise bundle work great, and you should be using them if you aren't using their new centralized cloud policy manager. https://twitter.com/SwiftOnSecurity/status/1321169309717200899?s=19