With DANE there will be no CAs, so yes, there will be no CAs to punish. But owners of root zone can already change DNS records to buy certificate in any CA, and

With DANE there will be no CAs, so yes, there will be no CAs to punish. But owners of root zone can already change DNS records to buy certificate in any CA, and you cannot punish them for that because they aren't required to do any validation above checking DNS records for non-EV certs. In worst case DANE is equally secure as current CA system (ok, except that weak RSA, but I hope it will be fixed soon). Why you want to keep CAs, when you have to waste resources on constantly monitoring and punishing them, while with DNSSEC you can ditch them? In both systems DNS root zones owners can buy/generate certificates for child zones. This was also addressed ad nauseam.