Yes, it’s a complete auth bypass. All you need is the email address of a user and they’ll likely sign CSRs for any domains under that account.

It’s the end for them, I imagine.