Why is securely setting up custom domains for github pages so error prone? The `<user>.github.io` CNAME record already contains the username. So why can another

Why is securely setting up custom domains for github pages so error prone? The `<user>.github.io` CNAME record already contains the username. So why can another user steal it? edit: apparently CNAME can't be used for TLD+1, only for subdomains, so you have to use a more error prone approach for those.