As far as I know. LE does not get access to the sites private key so they can not intercept traffic using their certificates. And if LE tried to replace certificates with fake ones, it would be spotted through certificate transparency like normal.