Transparency is not optional - Chrome and Safari don't accept certificates that aren't published in Certificate Transparency logs.

Certificate Transparency logs use Merkle Trees so that if they try to hide a certificate, it can be detected.

The system is designed to resist subversion, even by governments. While there are scenarios where a sufficiently-powerful attacker could successfully subvert the system, they run a high risk of being detected if they try. It's just not as simple as you imply.