Apparently you have to manually use --force-renewal for certbot to regenerate new certificates (I just did it just in case, even though I'm 99% sure that I'm not concerned).

I assume that by default certbot only checks the expiration date of local certificates against the system clock, it doesn't ping any external resources so it can't be aware that the certificate might have been revoked even though it hasn't expired.

I agree that it would be nice if there was such an option, although I assume that it would increase the server load significantly if certbot connected to letsencrypt's servers at every invocation so maybe that's why they didn't do it.