Of course impersonators might still register a similar-looking domain and verify with that, if they’re determined enough. But it’s better than nothing.