Why are Let's Encrypt certificates accepted by default by browsers?

I think you are misunderstanging what a SSL certificate actually certifies, and what it is designed to protect against.

A standard certificate only certify that the owner of the certificate actually controls the domain in question. So a certificate for g00dbank.com only certifies that the owner controls the g00dbank.com domain. It does not certify that the owner is a bank, that she is good, or that the site is in fact the well known Good Bank Incorporated.

So SSL is not designed to protect against phishing. Just because you see the green lock up in the left corner does not mean that everything is well. You also need to verify that you are on the correct website - that you are on goodbank.com (as opposed to the phishy g00dbank.com) and that goodbank.com is in fact the website of Good Bank Incorporated.

To make this easier for the average user, there is something called Extended Validation (EV) certificates. These also verify that you are the legal entity that you claim to be, by requiring you to do some paperwork. They browsers highlight them by displaying the name of the owner in the address bar.

So to get an EV certificate the phishers at g00dbank.com would have to start a real business (thereby leaving a papertrail), and even then they would probably not get one because their name is to close to a sensitive target.

Lets Encrypt does not issue EV certificates. They issue ordinary ones. But the phishers you encountered could have gotten a certificate frome anywhere. In fact, as IMSoP points out in comments, the method Lets Encrypt uses is employed by many of the established CA:s as well, the only difference being that Lets Encrypt is more efficient and cheaper. So this has nothing to do with Lets Encrypt specifically, and blocking them would solve nothing.

Certificate do not provide any more guarantee that what is in the certificate itself. In the case of Let's encrypt certificates, all that is guaranteed is that the server you are connected to belongs to the same entity that own the domain name you used to connect to it.

There is another class of certificate called "extended validation certificate" where the issuing CA do some more checks. Basically, the verify that the domain is own by an existing commercial entity. Browser will typically display such a certificate with a green indicator with more details (Chorme, for instance will add "the connection is secure and the company is known") to the description of the certificate.

Basically, the presence of a valid SSL certificate does not indicate that the target domain is safe. Even EV certificate do not tell you much (although it's a bit better).

Why does your browser trust certificates from the Let's Encrypt initiative?

Just to make this part clear: Your browser/computer trusts these certificates, because it acknowledged the root CA "DST Root CA X3" and stored it in a list with trusted certificates. The CA "DST Root CA X3" again trusts Let's Encrypt and has signed their certificate.

Are free/cheap/easy-to-get certificates a security problem?

No.

Having a signed certificate or serving https does not imply that the website is malicious or not. It only proves that you connected to a server that has a valid and signed certificate for the domain.