Currently, the Magisk module only copies the certificate to
/system/etc/security/cacerts/. However, even after I installed this
module on my Android device (Pixel 3a, Android 11, Magisk 23.0, Magisk
Hide disabled, no other modules enabled), the mitmproxy CA certificate
remained untrusted by all apps.

Looking through the filesystem, I found an additional folder
/system/etc/security/cacerts_google/ with about half as many
certificates as cacerts/. Modifying the Magisk module to also copy the
certificate to this folder made the mitmproxy CA trusted by all apps.