I would think it would fall on the zone operator to properly configure a CAA record to restrict issuance by an unauthorized CA.