Without DNSSEC this requires an attacker to 'global MITM' letsencrypt's DNS queries. That is a higher bar than before this change. Before, an attacker only nee

Without DNSSEC this requires an attacker to 'global MITM' letsencrypt's DNS queries. That is a higher bar than before this change. Before, an attacker only needed to 'global MITM' http requests. Your ISP could trivially do that. But your ISP couldn't just global MitM DNS queries for your domain unless you happen to use them as your registrar. That is much harder than having an attacker use HTTP verification and global MITM the end user.