If you're a CA you can just issue a cert and not publish it in the CT logs. You're not supposed to do that, but there is nothing stopping it. And the attack isn't stopped even if they do publish in CT. And you have to monitor for it anyway.
Every single mitigation for known Web PKI vulns can be worked around (if people use them, which virtually nobody does).
Every single mitigation for known Web PKI vulns can be worked around (if people use them, which virtually nobody does).