Why does every device need the Trusted Root CA installed?

Because trust has to go both ways, and this is the direction people forget. Your client's devices prove who they are to the network with a certificate. The network has to prove who *it* is to the device — otherwise anybody standing in the car park with a laptop could advertise the same SSID, and every phone that joined would hand over its credentials to them.

A device only believes a network is genuine if the certificate the network presents was signed by an authority the device already trusts. Passbeam runs a private authority for each client, which no device trusts by default — so the root certificate has to be put on the device first. Your MDM does that once — in Intune it is a Trusted Certificate profile. An appliance takes it in its own CA certificate slot.

This is why the order of the setup steps matters. Install the root, then the device certificate, then the network profile. Get it the wrong way round and the device has a perfectly good certificate and no reason to believe the network asking for it.

It is also why the device certificate profile and the network profile have to agree about the server name. If they disagree, the device refuses a network that was in fact genuine — and it fails silently, which is the worst kind.