Many countries have consumer protection laws that would limit this kind of sale, but those laws are not completely uniform within the E.U. So there may be legal liability separate and apart from the ToS issue.
The ToS for Let's Encrypt is governed by California law and contains the following provision that may be pertinent, although it could be more clearly drafted:
You warrant that You will not use Your Certificates to attack, defraud
or intercept the traffic of others.
The ToS also implies that Certificates are issued directly to an end user and are not for resale which would involve misleading registration information. But, as BlueDogRanch's answer shows, the company does not take the position that resale is barred by its ToS.
The hard part is who is equipped to do anything about it. While the justification provided by BlueDogRanch in that answer is colorable, meaning it could be difficult lawsuit to fight, I doubt that it would prevail on the merits in a jury trial.
The company could take action, but it is hard for them to invest much in policing a free service and it doesn't seem interested in doing so.
There could be consumer protection agencies (perhaps applying California false advertising laws that are probably being violated here) and perhaps a class action lawsuit.
The smart choice for an individual who is duped is to stop paying for something free.