In this context, I think "requires DNSSEC" is an opinion at best. "Requires" is probably the wrong word.

You are welcome to use CAA accounturi without DNSSEC and it will be effective.

Your zone may be vulnerable to an active man-in-the-middle DNS attack (which is hard to pull off), but it will still be protected against somebody figuring out how to upload an /.well-known/acme-challenge/ file on your domain and issue an unauthorized certificate from a foreign ACME account. This attack is much easier - I did it against a popular mail provider a few years ago.