Well obviously no one does, but buying a domain name and verifying every single time you try to scam any random person on social is quite a bit more involved/expensive than just generating a new account and updating the alias & profile.

It would have to be a very targeted attack for that to be likely. Generally it’s just a huge net cast to tons of different accounts hoping they will trick enough people to get a few to click a link in DMs or something.

Not a perfect solution, but far better than not doing it if you own the domain to your full name.