The problem is you're trusting the domain provider. Your npub is an identity that only you control.
Discussion
Give people something decentralized, and their first kneejerk reaction is, "Oh that's too hard, won't somebody please handle it for me so it's easier, thank you!"
What does that trust imply? But I thought that excerpt I included meant that you could @ people with their verified name.
It's basically the same thing as trusting organic certifiers. Nobody really knows who they are, but they certify things and say they're totally organic, and food gets the nice "USDA Organic" label, and nobody asks questions about it.
In the case of Jack Dorsey, he’s verified with CashApp’s official domain. No one except him would have access to that, so you can be sure it’s really him.