As I understand them, these are accounting audits, similar (if perhaps more detail) to a SOC2. The real thing keeping CAs from being gravely insecure is the CA death penalty Google will inflict if a CA suffers a security breach that results in any kind of misissuance.

It's not just Google, but also Mozilla, Apple, and Microsoft. They all work together on shutting down bad behavior.

Apple and Microsoft mainly have power because they control Safari and Edge. Firefox is of course dying, but they still wield significant power because their trusted CA list is copied by all the major Linux distributions that run on servers.

Sure. I think Google and Mozilla have been the prime movers to date, but everyone has upped their game since Verisign/Symantec.

that's good news about the CA's , but how about the publisher certificates that are in use?