>letsencrypt uses that to verify that my website has the magic file.
So, instead, use the other authentication methods. For example, DNS.
Is that easier to configure? (no it isn't)
Setting a single DNS record which doesn't need to be change is more difficult than setting a crontab to open port 80 "around the time you expect the ACME challenge"?
How's that?
Not really hypothetical.
Google "isp injecting ads", well most of it is from 10 years ago - but that is because now we have TLS everywhere.
And it is not attack on your blog but on readers of your blog, well your blog gets the blame of course in case they would be infected by malware or see adult ads.
Plus setting up letsencrypt isn't really really easy. Last time it was failing because I had disabled HTTP on port 80 entirely on my server… but letsencrypt uses that to verify that my website has the magic file. So I had to make a script to turn it on for 5 minutes around the time when the certificate gets renewed. -_-'
None of this is easy or quick, and people have other stuff to do than to worry about completely hypothetical attacks on their blog.