> Can Android OEMs, bundling Google Mobile Services for Android certification, choose different trust roots for verification?

They can already install additional system app stores, so it would surprise me if they can't allow additional verifiers.

> Isn't it partly for making malware distribution more traceable

Enabling developer mode does not make malware distribution more traceable.