> The entire security of the web PKI relies on the hope that if some certificate authority does something bad it'll become known.

Correct, but it's not a vain hope. There are mechanisms like certificate transparency that are explicitly designed to make sure any misbehavior does become known.