We should have a very small set of largely not-for-profit CAs run by competent security people, such as Let's Encrypt. There are just too many trusted CAs at the moment, it increases the risk of a breach like this substantially.
Let's Encrypt had their own security snafu. They issue certificates for longer than they were supposed to (1 extra second). It wasn't as big of an issue as this, but let's not act like they are some silver bullet
Honestly even if they were issuing certificates for much longer than they were supposed to, that is a way lower level of risk than "everybody in the world absolute-trusted a CA certificate that turned out to have a 256-bit private key crackable in seconds".