This is true except for the case of extended validation certificates.
These should be actually validated as sanctioned by the registering entity and the entity should also be verified.
It would in fact be perfectly fine for a CA to issue an EV certificate containing "GitHub, Inc." and a domain that GitHub does not actually own, but which they control because someone pointed their A or CNAME record to GitHub pages. The Extended Validation Guidelines[1] do not require domain ownership for the organization requesting the certificate, it's enough to control it in a way that allows you to complete one of the blessed validation mechanisms defined in the Baseline Requirements.
[1]: https://cabforum-travis-artifacts.s3-us-west-2.amazonaws.com...