Yes, locality can contain cities/towns/villages. The X.500 model was a bit fluid here, because it imagined a centralized global naming source with delegation (e.g. leaving it up to countries / states or provinces to manage naming - see early RFCs like RFC 1255), and that of course (thankfully) never came to pass.
With respect to the BRs, locality is left to the CA to demonstrate the relevant data source and verification and their determination. However, the notion of
localityName being a subdivision like a city, county, or geographic region is within reason, see e.g. RFC 2256. The complexity here, as it always is with regional information, is geopolitical. While
stateOrProvince have been seen as (explicitly) ISO 3166-1 and (implicitly) ISO 3166-2 , respectively,
localityName is a bit more fluid.
Note that, in general, the recommended way to report concerns is directly to the CA, since they MUST provide a preliminary incident report within 24 hours, which does not necessary trigger by filing a Bugzilla bug. Of course, if you're not satisfied with the answer, or still have concerns, opening a Bug or posting on m.d.s.p. is totally appropriate.