"Forbidden by policy" generally means one of two things:
- Let's Encrypt believes that the organization controlling the domain name is on the US Government's "Specially Designated Nationals list" which legally forbids Let's Encrypt from issuing certificates to them.
- The domain name is on a "high risk" list, of domains that have really high usage and haven't otherwise shown an interest in using Let's Encrypt certificates. They have a process for such organizations to request starting to use Let's Encrypt, though it involves getting lawyers involved.
For Yandex specifically, I don't know which of those (or both!) might be the case. But my guess would be that it's one of those.