How is that possible? If a CA is breached, doesn't that just mean it can create certs impersonating other sites? How does that break all of TLS?
But if a CA which is trusted in the Web PKI is "breached" then the nature of that breach determines the consequences for anybody who trusts the Web PKI (which means popular web browsers and a good deal of other software)
* If the breach results in bad guys having the root private key (typically realised as a physical device in a safe) then they can issue any certificate or certificate hierarchy using that key and it would (until you update things not to trust it) work. But this is extremely unlikely, it has probably never happened (it's unclear for Diginotar but appears the root was not actually taken by bad guys, they broke into a bunch of servers they didn't conduct a physical robbery)
* If the bad guys get one or more Intermediate private keys - which are online because they're used in the actual process of minting you a certificate although they're supposed to be protected inside hardware that shouldn't give anybody the keys - they can make any certificates under that intermediate, including further sub-CAs. Unlike a root the intermediate can "just" be revoked, and mechanisms to make that stick in practice exist for all major browsers.
* If the bad guys just break into servers that are responsible for issuance it's trickier. They might be able to cause the Intermediates to sign some certificates but not others depending on what they broke into exactly. For example they may be unable to falsify the date as there's no reason the server they broke into would be allowed to choose the date on a certificate, or they might be obliged to obey rules like CAA checking even if they don't want to because it's done by some other system they can't override. If the owners realise what's happening and turn off the power, the access goes away, the bad guys don't have the keys so they can't make more certificates.
* If the bad guys just broke into some subsidiary system they may only be able to cause issuance / re-issuance of certain specific certificates that system was allowed to cause. e.g. suppose Big Corp contracts with some CA to issue many certificates like springfield.bigcorp.example and smallville.bigcorp.example - there may be authority on file to issue any such certificate until say 2020-08-04, and if bad guys guess that Big Corp's password is "letmein123" they can use that existing authority to make themselves a certificate for fart.bigcorp.example no problem - but that doesn't get them a certificate for news.ycombinator.com or google.com without some other attack.