IMHO, this rule originated with X.400. The name form containing C, O, OU, and CN is largely derived from the "Mnemonic O/R address" of CCITT (now ITU) X.400, although in that standard there was also a mandatory administrative domain name. In that standard, C, O, and CN had to be single-valued, while OU could have up to four values (see the MTSUpperBounds ASN.1 module). I don't see anything in the directory standards proper (especially X.520 and X.521, where it would be expected) which is as clear as X.400 in forbidding multiple values of C and O while permitting them for OU.
Tom Gindin