It’s a cartel in the sense that the CA/Browser forum determines, on their own whim, which CA gets featured or revoked in your browser. And single-handedly impose technical restrictions like shorter cert lifetimes and less features. Stuff like eMudhra being able to compromise everyone shows its quite a vulnerable group of single-point failures as well, but still condoned by almost everyone.

ZeroSSL and Komodo does have free certs if I remember correctly. They’re still bound by the 90 days (soon to be 47) limit though