Again: individual site owners can reliably enable modern curve crypto in TLS. Nobody can do that with DNSSEC; all DNSSEC crypto is lowest-common-denominator, where the lcd is 1024 bit or even 512(!) bit RSA.
ECDSA P-256 and P-384 are widely deployed. New algorithms will take some time to be widely supported by peer resolvers, just as TLS 1.3 will take time to be widely supported by web sites (browsers are more agile, but many websites still don't do forward-secrecy with TLS 1.2).
Algorithm agility is a thorny problem.
Algorithm agility is hard, but it's much harder in DNSSEC than it is in TLS.
It is sufficient to note that every PKI is as secure as its weakest link. If my CA is 512 bit RSA, that is the security I am going to get.
That public DNSSEC infrastructure is neglected in places is not really controversial or what we're discussing here, but the use of a singular trust root in place of hundreds should not be taken as evidence of incompetence from the protocol designer.