Sure, but no open-source project wants contributions by contributors who do not legally own the code because in that case the actual owner of the code can petition the court to issue an injuction on the project preventing further distribution of the code till the offending code is removed from the project. (They can also sue any user of the project for damages.)

Wikipedia has to worry about the same thing, BTW: contributors who upload text whose copyright is owned by some entity who never consented to the upload, and they have policies in procedures in place to correct it when it happens.

It's not like CLA's are the only obstacle to employees contributing to the open-source projects. In fact, you might say that the main purpose of a CLA is to surface copyright-ownership problems early, when the cost of correcting them is lower.

Copyright attestation is only one small element of a CLA. I have no problem with an attestation of ownership.

I think this is why samba refuses contributions from corporations:

https://www.samba.org/samba/devel/copyright-policy.html

I agree that no project wants that situation. But many projects are willing to accept the risk of it happening, and instead have reduced friction with no CLA.