I suppose that's easy bordering on trivial for an attacker of sufficient skill. At least it used to be. Is that no longer the case?

If there is a blacklist in place, absolutely each and every one of the hundreds of CAs need to adhere to it. One mistake or one exception and I could still get a misissued certificate just as easily as ten years ago.

Google can probably get it revoked very quickly, but we all know how well that works in practice. The only saving grace for the CA system is key pinning, and that's the only reason all those corrupt and/or incompentent CAs were exposed lately. But key pinning is not enough in itself. It is complementary to your certificate validation path(s).

That's great, if you are Google. I unfortunately, am not Google.

You are not Google. How many people are potentially affected if the security of your domain were to be compromised?