Why does every device need the Trusted Root CA installed?

Because the device has to check the network too. Devices prove who they are with a certificate. The network also has to prove who it is to the device. Otherwise someone could set up an access point with the same network name, and devices would connect to it.

A device only trusts the network if the network's certificate was signed by an authority the device already trusts. Passbeam runs a private authority for each client, which devices don't trust by default, so the root certificate has to be installed first. Your MDM does this once. In Intune it's a Trusted Certificate profile. An appliance takes it in its own CA certificate setting.

So the order matters. Install the root, then the device certificate, then the network profile. Done the other way round, the device has a good certificate but no reason to trust the network asking for it.

The device certificate profile and the network profile must also agree on the server name. If they don't, the device refuses a genuine network and shows no useful error.