> there's no barrier to anyone issuing a cert to any particular domain while attempting to circumvent domain authentication.

Let's Encrypt has a much better track record at preventing people from issuing certs for random domains compared to many other commercial entities.