It's similar to how compilers often have limits on compile time constructs that are maybe not explicitly in the standard, but that no one really cares about. S

It's similar to how compilers often have limits on compile time constructs that are maybe not explicitly in the standard, but that no one really cares about. Say, if you design some recursive template in C++ that resolves after a million steps, that might technically be a valid program according to the spec but no compiler will actually accept it (I think the C++ spec actually allows recursion limits, but that's beside the point). This vulnerability is a bit like not having that limit. So, maybe an RFC to explicitly call out the need for some limit on DNSSEC processing time will be issued, but in practice no one except for attackers should ever come anywhere near the newly imposed non-standard ones.