It is the responsibility of the CA to disclose issues to its auditors, not for the auditor to discover them. WoSign was aware of this, because some of the issues in this document were disclosed to auditors and included in their report.
The completeness of WoSign's list of 72 certificates has been called into question by a discussion participant who testifies that [https://crt.sh/?id=30335331 his certificate] was validated using port 8080 but does not appear in WoSign's list.