The hijacker effectively controlled the IP range used by the domain, not the domain itself.

There's a big difference between the two. The hijacker would not have been able to do dns-01 verification. Restrictive CAA records would have prevented the hijacker from having the certificates issued.