They need to do at least something. NIP-05 isn’t that hard if you’re savvy with websites like a large organization should be. But even a message from a known account verifying the the npub would be a temporary/short term way to verify.