In this case it seems like the attackers targeted an SDK. Subresource integrity would have helped here.
https://developer.mozilla.org/en-US/docs/Web/Security/Subres...
In any case they could've hijacked the IP for the authorative DNS server, but that would at least add some complexity.
Also, this assumes their CA actually did their due diligence and the hackers didn't just fool them into reissuing the certificate to them.
So if your site pulls in js from another site without sub resource integrity, and the other site doesn't have CAA configured you are vulnerable.
Personally, I think anyone who has a heightened attack risk ought to contemplate a CA that does some form of more thorough validation.
Sub resource integrity wouldn't help if they could have re-routed requests from klayswap.com