This is how these sort of attacks have always worked. Get something that's just close enough so that it passes the glance attack. If someone doesn't notice anything in the first few seconds, you've done half your work right there.
Since the domains aren't being used, we can't say what the intention was, but it's being judged as part of a pattern of behavior by Wosign.
It's a trust problem because of the pattern of this particular CA. Whether you call that a security problem or not is semantics. If not for the existing pattern of behavior, people would be a little more willing to look charitably on this as an honest mistake or trying to help, but given the history the assumption of good faith has been considerably weakened.