Yes; if someone hijacks example.com's main A record, that gets caught at the SSL level. If someone hijacks example.com's cookie record, that won't be caught; t

Yes; if someone hijacks example.com's main A record, that gets caught at the SSL level. If someone hijacks example.com's cookie record, that won't be caught; they just write themselves permission to have their page access example.com's cookies. The same info could just be hosted by example.com (at some /.well-known path or whatever). The web could generate a lot of hits against that. The DNS records could be (optionally?) signed. You'd need the SSL key of the domain to check the signature.