The answer is the same as the reason x509 "works" at all. The CAs don't issue invalid certs because if they did, they wouldn't be trusted anymore. In terms of

The answer is the same as the reason x509 "works" at all. The CAs don't issue invalid certs because if they did, they wouldn't be trusted anymore. In terms of technical limitations, nothing stops any CA from issuing any cert they want. It's the business consequences that stop them from doing so. If Let's Encrypt wants to keep themselves on the trusted-root-CA list of Windows, Chrome, MacOS, et. al., they need to keep their noses clean.