Let's say you have a CSR that filled with incorrect data and you need to issue a certificate to the associated private key holder. The private key holder will not issue another CSR and will not disclose their private key. Can you overwrite every data field when you issue a corresponding certificate?
The issuing authority has no requirement or responsibility to respect anything in the Certification Request (CSR), except the public key.
The StartSSL Certificate Authority, for example, did exactly that: Discard everything except the public key from the CSR, filling in everything else based on your account.
So, it's all down to whatever process exists with a specific issuing authority, and what tooling they have for working with that process.