While you're technically correct that the specification doesn't specifically say that you can't have a CNAME on the root domain, it is still true that you cannot have a CNAME on the root domain because DNS requires that you have SOA and NS records on the root domain, which means that a CNAME is not possible due to the rule you cite.