The issuing was detected almost immediacy thanks to CT, and as we move to shorter certificate lifetimes the impact is continually reducing.
The CAA record in dns is a weak link though.
Which means that the risk to you or I or the general public is low.
But FWIW: it also tends to argue that this is the aftermath of a coordinated, targeted attack against a single high value target (or at most a small set of targets they could hit within the window). The attacker knew they had a gun with only one bullet, and we're just hearing the muzzle report.
Edit: Someone more curious than I am might be able to answer this by seeing when the CRLSet was published. https://github.com/agl/crlset-tools
When a company has 3 billion customers, there's no practical cert lifetime that really reduces exposure. Five minutes would sniff enough traffic to do significant damage; one day would impact a big chunk of their users and five days would be nearly 100%
General solutions are tricker, and it’s good that Google limits its “special” case. When bbc.com or al jazzera or cnbc or whatever is hacked that’s a problem that is only solved by generic solutions.