This is pretty bad. Someone circunvented the ban on emitting public certificates but also disrespected Google's CAA rules. Hope this CA gets banned on Microsoft OSes for good.
The reason someone would want to to be able to issue one of these certs is it essentially allows them to eavesdrop on normally unreadable connection data because the device thinks the system in the middle is actually a trustworthy endpoint, and not a malicious TLS terminating proxy.
No one whose devices are by default trusting that CA now have any guarantee of confidentiality on any connection to a system presenting those issued certs.
Basically the way certificates work is that whoever has a certificate for a domain name will be able to serve anything they want and browsers will accept this is the real domain. To turn this into an attack, they just need to trick your DNS into pointing your to their machine, or to intercept your traffic even while you're accessing the real server.
Getting a certificate for "mytotallyrealnotascamwinkwink.phishing.com" is not useful in any way for an attacker: the whole idea is to have the user think they are on a trusted site like google.com, while in reality looking at the attacker's site.