But that means they can't verify it, right? Couldn't a malicious actor use this to attack their competitors? Add an internal DNS entry for your competitor's do

But that means they can't verify it, right? Couldn't a malicious actor use this to attack their competitors? Add an internal DNS entry for your competitor's domain, spin up an internal server hosting some malware and open it from chrome.