You've ignored the meat of my comment, which is that CLAs are more about circumventing the project license than they are about demonstrating due diligence. But on that note...
Even Microsoft's CLA has a backdoor that doesn't require the author of the code to sign the CLA. You can, for example, copy and paste some procedures from a compatibly licensed open source project and mark your submission as containing code from a third party source. (E.g., "What's <project>'s module resolution procedure? Ah, just copy the file defining that class into the source tree; it's already under MIT.")
And as for "knowingly and intentionally" submitting code, Microsoft's CLA in particular exacerbates this rather than ameliorates it, because it broadens the definition of a submission to one that I'm sure would surprise almost every contributor who has actually signed the thing. Any code that you even discuss in a channel affiliated and run for a particular project by Microsoft constitutes a submission if you are the original author of that code, regardless of whether you actually submitted a patch for inclusion in the project, or even made any sign of interest in the development of that project whatsoever. (E.g., signing the CLA and submitting changes for project X means Microsoft gains control of your work around project Y if you link or distribute a personal project on the message board or mailing list for such project Y). So that argument is bunk.
> The other risks that you're talking about are largely risks of fraud which make the situation messy.
I'm at a loss for words.
> An OSS project that just says, "We just take whatever code someone sends our way, while trusting blindly in what they say"
Weird to even use this characterization, since that's an accurate description of exactly the sorts of CLA processes we're discussing.
> The CLA translates the situation into, "And the person submitted the code committed outright fraud and deceived the project owner", which will not necessarily be easy to establish merely from a commit
I have a sort of rule of thumb that I think most readers follow whether they realize it or not. It goes like this, "The first person to use the word FUD loses." Even so, I'm having trouble seeing this comment coming off as anything but that. It comes off as nothing more than casting incredibly dubious aspersions.
Can you point to an instance where such a thing has actually come up in litigation? Alternatively, cite an instance where even just a credible threat of such a thing has come up.
Both Mozilla and Linux each have long and storied histories; both are poster children for what large, successful open source projects can achieve; and both have corporations with serious money backing them. They somehow have managed to get along fine for decades without anything like that posing a realistic problem for either project, or even worthy of a footnote in their history, for that matter.
For a more recent example, I'll point out again that Apple deliberately chose a CLA-free contribution process for Swift, which was initiated as an open source project only months ago. Do you think Apple has reason to believe that the threat you mention is a credible one but that their project (or maybe just some characteristic of the company) has some inherent detail that renders them immune to it in this case only?
CLAs, in the form that we typically see them, are bullshit, and almost every defense of them fares even worse. Once again, CLAs exist for one reason, which is to grant the recipient org rights beyond those they'd ordinarily only receive through the license (that they chose!), e.g., so they can redistribute it under alternative terms, should they decide to do that for whatever reason.
This would be a more productive discussion if you'd actually focus on that, rather than invoking unverifiable claims about advice from phantom counsel and the threat of submarine suits.