I can field this one. DNSSEC was conceived with support for a traditional zone transfer process. When you edit the zone, you sign it once (potentially offline) and send it via zone transfer to all your authoritative servers. In that context, the authoritative servers can't do things like serve the best A or whatever record given the recursive resolver contacting them and global state. Instead, you generally end up with your keys online on all the authoritative servers. Which means if your DNS account is hacked, chances are, the hackers are in a position to change your records. If your registrar account is hacked, the hackers are certainly able to remove or replace the DS records at the registry, so DNSSEC doesn't help there either (good auth at the registry and registrar and maybe registry lock help there).

DNSSEC might help with MITM, if you only communicate with recursive resolvers you trust to properly implement it and not sneak in any garbage, but it doesn't help against account compromise.