If you're referring to a properly run CA, then they're a good model to follow. Some of them, obviously, do not implement proper operational security procedures, but a good many of them do. It's usually required in order to have your Root CA certificate added to the trust store of major browsers, OSes, etc. I was a senior engineer for one of the larger commercial CAs, and started off my career as an engineer for the world's largest gov't CA. Biometrics, HSMs (hardware security modules) for storing the keys, offline root CAs, documenting EVERYTHING, armed guards, etc. are the norm. The CA software platforms themselves are usually assessed for FIPS, Common Criteria, etc. compliance. And we were audited. All. The. Time. I can't speak to Let's Encrypt, but the bigger companies that make their money in the CA space are insanely serious about security.