Right. NIP-05 is just an identifier. At least it prevents bot action, but does not verify a specific person. Could be anyone who has access to a specific domain as well.