That's correct. Browsers offer other mechanisms like HPKP to mitigate attacks through rogue CAs. Active CAA checks by browsers would either be soft-fail like O

That's correct. Browsers offer other mechanisms like HPKP to mitigate attacks through rogue CAs. Active CAA checks by browsers would either be soft-fail like OCSP (i.e. useless in the face of an active adversary who could block the request or spoof the response) or cause a lot of unnecessary warnings because of failed requests. You'd also have to force every site on earth to create a CAA record if you want it to be hard-fail. That's going to be impossible.