It's a plausible suggestion that all services that provide basic critical infrastructure for the Internet (e.g. DNS, Certificate Authorities, ISPs and network providers) should have a very high level of security testing given their attractiveness to attackers.

the only problem is... who's going to pay for it? the CA model and the DNS model tend to be a very low-cost one which means there's unlikely to be the kind of money available to pay for expensive red-teaming on a regular basis, let alone running infrastructure that would resist their attacks..

Or more specifically, do security auditors have red teams authorized as part of their audit?

In my limited experience (infosec for a big 4 firm), the answer is no. The audits are done as cheaply and as quickly as possible. I worked alone, in fact, and essentially did process testing (read: document review).

Should it be? Yes. Is it? No.

When will it be?

When enough people are screwed by it to justify the requirement which will justify the resultant cost increases.