Two, while Google is presumably watching CT logs for google.com certificate issuances, I'm certainly not watching my personal website. I suspect most people aren't, so they could probably get away with issuing e.g. a shadowsocks.org certificate and have a few days of successful attack before anyone notices. This is probably not what you want for dragnet surveillance, but it's great for an attack against an individual (whether conducted by a government or just some private party).

So yes, the state of the world is quite a bit better than it was before CT, but adding CAs remains a risk. They're only worth adding if there's a reason to do it. (StartCom's free certificates used to be a really good reason.)