What CAA actually protects against

Before CAA existed, any publicly trusted Certificate Authority could issue a valid certificate for any domain, as long as the requester passed that CA's domain-control validation — meaning a compromised or careless CA (or a compromised validation step) could result in a rogue but technically valid certificate for a domain, issued by a CA the domain owner never intended to use. CAA closes that gap by letting a domain owner publish, in DNS, an explicit allowlist of which CAs are permitted to issue for their domain at all — and since 2017, CAs are required by the CA/Browser Forum baseline requirements to check this record and refuse issuance if the requesting CA isn't listed. It's a defense-in-depth control specifically against unauthorized issuance, not a replacement for the CA's own domain-validation process.

Why no CAA records is the normal, unrestricted default

CAA is opt-in: a domain with no CAA records at all hasn't restricted anything, and any publicly trusted CA can issue for it — exactly the same as before CAA existed. Seeing "no CAA records" during a check is very common and not itself a misconfiguration; it just means this particular protection hasn't been turned on. Organizations that care about limiting issuance to a specific known CA (their existing provider, say) publish a CAA record specifically to close that gap — until then, the absence of a record is simply the unrestricted baseline state every domain starts in.