It is not needed to get a forged certificate for g00gle.com. The person behind the phishing site just needs to obtain a regular certificate for that domain. Of course requesting such a certificate may fail as a computer or a human may be triggered by the likeliness to google.com. But otherwise any owner of a domain can create a key pair and send a certificate request to any commercial CA. Note that registering has the nasty side effect of making yourself known to the CA.

It's not possible to use the orginal google.com certificate. The certificate contains the information about the site / site owner, the issuing CA and the public key. You would need the private key as well to use the google.com certificate.

The problem with certificates issued to rogue parties occurs during man-in-the-middle attacks where the communication can be routed to another computer. In that case the attacker can choose to intercept, read and change traffic to e.g. google.com. The attacker may also impersonate the server or anything in between.

In the case of google.com the Iranian government was involved. As it controls (most of) the infrastructure of Iran's internet the routing to another computer is easy. More close to home (for most of us), attackers can also setup rogue WiFi access points and use that to route traffic.

Note that plain DNS doesn't contain security measures, so anybody controlling the network also controls the way that IP addresses are mapped to names and vice versa.