That sentence doesn’t take the current situation into account. It’s not just “they” - the CA - that can do this, it’s anyone who can figure out their weak encryption key. Which makes the “if successful somehow” a whole lot more likely - consider what malware distributors can do with this, for example.
Even with the key, which is 4 apparently, you still need to impersonate another domain to have any success. That is hard to do unless you control people’s networks like in a WiFi hub.