Correct me if I’m wrong, but isn’t the CA only signing your public key to prove identity/authority? I don’t think the CA can magically MITM every cert they sign.
The impact is not serious enough to warrant a $1m entry fee, IMO. At best, someone could impersonate a site. They’d also have to get other things in line (e.g. DNS hijacking) to be at all successful anyway. And it’s not like most people are authenticating certs themselves. They just trust browsers to trust CAs that vouch for you and prevents those scary browser warnings.
It doesn’t improve encryption compared to a self-signed cert though.
You’re not alone.