So to your point you would see the attack being that the .LY registry would change the NS records for my (fictitious) .LY domain to point to a different set of

So to your point you would see the attack being that the .LY registry would change the NS records for my (fictitious) .LY domain to point to a different set of name servers? i.e. removing my servers as the authoritative ones? And then being able to serve out whatever records they want to? (including a TLSA) Is THAT the attack you see?