haven't heard about dns-account-01, thanks! Heard only about dns-persist-01.

I meant to say that CAA record can also specify account, or at least Let’s Encrypt docs mention it[1]. So unless attacker has access to victim's account - they can't get a cert (unless they can hijack dns, too).

[1]: https://letsencrypt.org/docs/caa/#the-accounturi-parameter