Because he proved he could control the majority of name servers, that means that he could change what server his nameservers respond with and have a good chance

Because he proved he could control the majority of name servers, that means that he could change what server his nameservers respond with and have a good chance of getting his bad DNS records used So any site hosted on the io tld could be duplicated and hosted on a bad box that could steal credentials, install malware, without impunity and without much detection. --- It can't be mitigated in the long-term as far as I know. There might be some short term solution but once your browser needs to look up the IP, he has got you. The solution is not allowing nameservers to be registered as far as I know.