Generally yes - a compromised CA can be used to issue certificates for any domain, which is why when a CA is compromised the first step is usually for browser vendors, OS vendors, etc to immediately remove the compromised CA from their trust lists.

This is the compromise. In exchange for having the ability to easily establish an encrypted connection to pretty much any public web service, the tradeoff is that the entire public internet's encryption is only as good as the operations of the weakest of the big public certificate authorities.

Yes, exactly this.