Yes, this is going to further insecure the Internet by forcing people back to the for-pay CAs, unless Startcom manages to fix it basically instantly and forces everyone to get new certs, very very quickly.
As I understood it any certificate in the chain (except the root) is considered. Validity is usually longer for intermediate certificates [such as the Starcom intermediary, quoted above].
