“In short, this means that only someone with your ACME account private key can obtain certificates (though note the caveats below).”
Domain validation proves you control a domain for a few seconds. Anyone who can intercept traffic for those seconds can get a valid cert. ACME-CAA pins issuance to one account key. The spec was written in 2016 and it took until now for a single CA to support it.