There's a level of trust involved if you're using someone else's domain through a paid NIP-05 verification service. And in these cases it's pretty easy to impersonate others since it relies on the service operator to screen for fake accounts