Actually many customers let the CA generate the private key and copy it onto their servers, but that's not the point. It's a trust problem because of the patte

Actually many customers let the CA generate the private key and copy it onto their servers, but that's not the point. It's a trust problem because of the pattern of this particular CA. Whether you call that a security problem or not is semantics. If not for the existing pattern of behavior, people would be a little more willing to look charitably on this as an honest mistake or trying to help, but given the history the assumption of good faith has been considerably weakened.