Did the requesters of that actually control those domains (hint: they didn't)? If I register the domain superawesomepaypalscam.com then that is my domain name. Since it is my domain name and I can control it, obviously I can get a domain validated SSL certificate for it.

If I don't control example.com, then obviously I should not be able to get a domain validated SSL certificate for it. If I did, I would be able to MITM people trying to visit example.com (which is not my website), and that is bad.

This entire situation is basically working as intended.