It was cheap and easy to "steal" microsoft's certificate in 2001. http://cc.uoregon.edu/cnews/spring2001/mstheft.html
If your argument is that Verisign sucks, though, I won't contest it. I'm not saying the CA business model is good; I'm saying that it's silly to say you can run SSL without CAs.