The ambition is that this will be addressed by supporting RFC8657[0], which would allow domain owners to restrict HTTP-01 issuance by declaring an issuance policy through DNS records. It's been live at staging for years and still waiting to make it to prod[1].

DNS-01 attacks are by default similarly vulnerable to MitM between the issuer and your DNS server, which can be mitigated by setting up DNSSEC.

[0]: https://datatracker.ietf.org/doc/html/rfc8657

[1]: https://community.letsencrypt.org/t/prod-support-for-rfc8657...