DeFi is, after all, notably devoid of serious compromises :-)

More seriously: there are cryptographically sound schemes (like CT) that address CA compromise.

CT is cool, but who is writing/submitting those logs?

There are multiple, independent entities both maintaining and submitting to the logs. The short answer: CAs submit precertificates to the logs; the logs respond with signed certificate timestamps that are embedded within the ultimate certificate rendered to the user. User agents (i.e., browsers) cross-check against the logs using the SCTs. Third parties ("monitors") additionally watch the logs for suspicious events (unexpected issuances, unusual certificates being signed for, etc.)

There's a nice visualization here[1].

[1]: https://certificate.transparency.dev/howctworks/#stepby