What's worse is, if this hadn't come to light, how would you even know when an attacker issues a cert for your domain?

Well you might think, oh I can monitor the certificate transparency logs.

I would say well, good luck downloading and parsing terabytes of certificates as they are logged. Then there are CAs whose logs will rate limit you in a way such that you can't catch up to the certs being logged with one server and IP. The system might "work" but not for domain owners. Good luck.