And those corporate entities (e.g. in this case the multi-billion dollar public company Symantec) are what's on the line when it comes to trust store sanctions. That's why Diginotar no longer exists, even though the Dutch Government tried to rescue it. (Side note: The person who originally started Diginotar was a notary...) and it's why StartCom / WoSign are probably screwed although they're limping along in the Chinese market for now.
I have no idea why you think that seeing a fake ID helps "stop the attack from scaling". You don't have a photo of "the bad guy", you have a photo of somebody who did what they were asked for $20 and a packet of smokes.
And again, validation is not a job for one individual, imaginary million dollar bonds don't make that any less true. Usually domain validation is automated, with the automation overseen by a group of employees, but even where it is not there will be pair reviews or group reviews so that no single person can bypass the system.
Creating the right policies and enforcing them becomes a job for management, for company directors, and where appropriate for the shareholders. A CA must hire auditors to examine these processes. And the audits are reviewed by trust stores. The audits give us confidence that each CA has suitable policies in place to obey the BRs. I would like to see the auditors work directly for the trust stores, but the situation we have today is able to be effective.
For example in the case of WoSign Mozilla told the auditing parent company - EY which used to be named Ernst & Young, a Big Four professional services company - that the branch used (EY Hong Kong) would no longer be accepted as an auditor by Mozilla because based on the available evidence its auditors either had colluded with WoSign / its CEO Richard Wang or were incompetent.