It looks like bluesky only just figured out (in the last couple of weeks, I think?) that even if you authenticate foo.example.com they need to keep foo.bsky.soc

It looks like bluesky only just figured out (in the last couple of weeks, I think?) that even if you authenticate foo.example.com they need to keep foo.bsky.social reserved, because otherwise they immediately get snapped up for impersonation. So, yeah, possible and already happening, but at least they're trying to mitigate the worst case of it.