Correct, and certificate transparency exists pretty much specifically to counter this threat. By requiring certificates to be publicly logged to be valid it be

Correct, and certificate transparency exists pretty much specifically to counter this threat. By requiring certificates to be publicly logged to be valid it becomes trivial for domain owners to monitor all publicly valid certificates in existence for their domain(s). A CA that has been compromised or is being compelled by a government can still issue a valid certificate, but it becomes impossible to hide both that it was done and who did it.