I have marked CNNIC root cert untrusted on all of systems I can control. It bothers me sometimes when some providers with "good" reputation uses them, like azure china. I had to manually add the server certificate to trusted list, just to manage my vms. Otherwise, I barely notice the issue.
It looks that even CNNIC certs themselves weren't widely deployed, correct me if I'm wrong, most of Chinese sites who wants to employ TLS doesn't do it right, for example, 12306 has its own root and some sites I use daily has a self-signed CA with random input in all of the fields.
If you think the company that has agreed to collaborate with a Chinese company to make a different version of Skype (Tom-Skype), for the sole purpose of letting the Chinese government spy on Chinese citizens' communications in real-time, can be "trusted" to not have backdoored cloud services in China, then I have a bridge to sell you.
Microsoft has proven again and again that it's willing to make any concessions to the Chinese government if there's the slightest chance of them making an extra percent market share in China. We saw that when Google was hacked by the Chinese government, too. Microsoft was more than happy to agree to all the censorship policies Google didn't, because it meant that maybe possibly that would earn them some market share in China, after Google would be gone - it didn't anyway. Baidu took all that difference Google lost.
This isn't just about earning market share in China. Just about any organization that operates in China (or hopes to) has a vested interest in, e.g., having reliable email access there. If your company uses Google products for email, etc., then these days you'll have some real challenges making them work for folks over there. Microsoft can capture a lot of American business that way. (Concrete fears about employees losing crucial access tend to outweigh philosophical arguments about government surveillance when folks sit down to make these decisions.)
It looks that even CNNIC certs themselves weren't widely deployed, correct me if I'm wrong, most of Chinese sites who wants to employ TLS doesn't do it right, for example, 12306 has its own root and some sites I use daily has a self-signed CA with random input in all of the fields.