I am not a lawyer, so I am sure there is nuance here that I am missing. However, that interpretation of the ownership is a fairly narrow inferred one, which is

I am not a lawyer, so I am sure there is nuance here that I am missing. However, that interpretation of the ownership is a fairly narrow inferred one, which is to say that ICANN says "WHOIS data needs to be accurate" and "Transfer procedures need to go to the owner via the data in whois", ergo whoever is in the whois must be the owner. Some registrars, however, say "Nonsense, the owner of the domain is the Registered Name Holder, and we maintain that information, and the whois privacy is just a registered agent who will pass that information back to the registrant". I think it's telling that the Njalla ToS linked elsewhere does not mention ICANN, UDRP, or WHOIS as a sign that they have not thought through the implications of what they are proposing to do. EDIT: also, a practical step for transferring a domain is to ask the registrant to disable whois privacy to do name and address validation, which might also mitigate the "who owns this domain" concern