It's actually pretty difficult to enumerate all trusted CAs (or even just what organizations are running CAs). Certificate Transparency certainly helps there, but it's not fully required, and doesn't solve all problems.
The DigiNotar attack (from 2011) was mainly chosen because it's well known and easy to convey. It wasn't even that technically effectively because Chrome had Google's keys pinned, so it was immediately blocked and reported (like you would get with CT today). But, only in Chrome.
More recent examples of mississuance, like tricking Comodo's OCR-based validation [0] or spoofing DNS to hijack Let's Encrypt issuance [1].
CA's are always going to be vulnerable to these sorts of attacks, and they have such a broad attack surface and so much systemic trust (i.e power) that can cause unbounded damages with any error.
Basically, only the root record parsing is done in JS and then passed to unbound for resolution. Though it is possible to run a pure JS resolver, it's not really recommended.
The problem with this method is that it requires a side channel. This is the real beauty of public key cryptography, you can negotiate a secure channel over an open channel. (*Authentication sold separately)