Chromium's code (linked as the story) only applies these rules to certificates from the Web PKI, not to a private CA.
Mozilla has no checks, I presume the story title names them because they've agreed on this policy but they don't actually enforce policy in the browser code itself.
Or at least they didn't when I asked them months ago about this topic.
