I would assume Let's Encrypt didn't have the CAA records cached, as they had never issued a certificate for the domain. We can't expect them to cache every possible CAA record, and even if they did, that wouldn't be a silver bullet. So I agree that, in this case, CAA doesn't help.