It's not. A CA can revoke only certificates that they themselves issued, so the harm that a CA can do through inappropriate revocations is limited to its own cu

It's not. A CA can revoke only certificates that they themselves issued, so the harm that a CA can do through inappropriate revocations is limited to its own customers and their users. If a CA gets a reputation for doing this, its customers can simply take their business elsewhere (this may be costly and inconvenient, but it's always an option, though in the HPKP case it requires them to have planned ahead). This gives CAs a clear incentive not to revoke certificates inappropriately, so the system works. By contrast, illegitimate issuance by a CA that browsers trust is a threat to everyone's security. Furthermore, the parties directly harmed—the owners of the domains of the illegitimate certificates and their users—typically have no relationship at all with the offending CA, and consequently no direct recourse against it. That's why browser vendors—the only parties that CAs truly have to answer to—have to get involved in such cases.