You can just issue new certificates one per year, and otherwise keep your personal root CA encrypted. If someone is into your system to the point they can get the key as you use it, there are bigger things to worry about than them impersonating your own services to you.
Companies try to maximize green per red. By paying less, and getting the same, they maximize that, year after year until (in a temporary and unforeseeable setback) you leave for… Bluer pastures, apparently.
There are different sorts of companies, and the more they think of employees as a number of years of experience plus a stack of skills, the more susceptible they are to believing that replacing humans with other equally skilled humans is a productive way to spend their time.