"paypal.com in the name" is a bit too ambiguous. You can register a subdomain like "paypal.com.example.com" and acquire a certificate for that, that's correct. There have been no mis-issuances under the actual domain "paypal.com", to my knowledge.

Here's a blog post explaining why Let's Encrypt does not think it should be the CA's job to prevent this[1]. At least two browser vendors seem to share this sentiment[2][3].

[1]: https://letsencrypt.org/2015/10/29/phishing-and-malware.html

[2]: https://groups.google.com/forum/#!msg/mozilla.dev.security.p...

[3]: https://groups.google.com/forum/#!msg/mozilla.dev.security.p...