All that was true until fairly recently. Today, you can get certificates for free and there’s more transparency than ever thanks to CT.

What would you suggest as an alternative? TOFU?

I could see that for local applications (e.g. making mDNS/.local and private IP certs TOFU capable by default would be amazing, and maybe even for some explicit hobbyist public TLDs?), but I don’t think I’d love it for my bank or email provider.