Clients will check the pubkey on the domain.

Imagine e.g. Larry fink having a @blackrock .com nip05. Sure other people from BlackRock can also have one, but you can't add your npub on their server. Clients will check the file and warn if your npub doesn't belong to the domain.