It doesn't seem to actually require DNSSEC. Let's Encrypt will happily use these new fields to restrict issuance, the same way they were checking CAA records previously, for domains with and without DNSSEC.
Before, an attacker only needed to 'global MITM' http requests. Your ISP could trivially do that. But your ISP couldn't just global MitM DNS queries for your domain unless you happen to use them as your registrar.
That is much harder than having an attacker use HTTP verification and global MITM the end user.
You are welcome to use CAA accounturi without DNSSEC and it will be effective.
Your zone may be vulnerable to an active man-in-the-middle DNS attack (which is hard to pull off), but it will still be protected against somebody figuring out how to upload an /.well-known/acme-challenge/ file on your domain and issue an unauthorized certificate from a foreign ACME account. This attack is much easier - I did it against a popular mail provider a few years ago.
I guess this is Fastmail :)
In 2014 Rob Mueller wrote: "Our future DNS plans include DNSSEC support (which then means we can also do DANE properly, which allows server-to-server email sending to be more secure), DMARC record support, and ideally one day Anycast support to make DNS lookups faster."