“They can put SCTs in the cert, and still not publish to the logs, nobody is auditing the logs for every cert every browser sees”

I don’t think you can get the SCT from a log without the log publishing it? That would defeat the purpose.

“Certificates that support certificate transparency must include one or more signed certificate timestamps (SCTs), which is a promise from a log operator to include the certificate in their log within a maximum merge delay (MMD).[4][3] At some point within the maximum merge delay, the log operator adds the certificate to their log.”