I think it’s a big misunderstanding, not a flaw.

nip-05 is just a way to alias a pubkey with a domain name. that’s it.

using a nip-05 provider you don’t control is like hosting your blog on facebook or blogger. they can rug you at anytime. but that doesn’t mean the capability is flawed, it means you chose a custodian.