The domain verification process is indeed a weak point - but there's now the upcoming introduction of MPIC (Multi Perspective Issuance Corroboration) to help wi

The domain verification process is indeed a weak point - but there's now the upcoming introduction of MPIC (Multi Perspective Issuance Corroboration) to help with that (essentially checking the domain challenges from multiple network perspectives to overcome the risk of BGP-hijacking and similar attacks). Also, if there's a non-internet connected network or device that uses TLS, it shouldn't be using public/webPKI certificates. Use a private CA, get the root on the managed devices that connect to it, and the problem goes away. That's always been an option.