I think it’s true that they can do “whatever they want”, but only once, because they’ll lose the right once found. The issue is the time between breach and punishment.
Of course then the question is how quickly browsers can roll out an update/config to distrust all future certs from said CA.