That's true. But I think it's the same case as a bad actor owning a domain for himself. They still need to do some policing so it doesn't pull down the whole TLD