Solves part of it. They still control your HTTP and can make LE issue a certificate for you. So actually solves nothing.

Unless you had a CAA record saying only LE certs from your account are valid. And maybe you want that record to be authenticated.