Ah, gotcha. Sure, the .COM registry could return NS records for example.com pointing to a controlled name server that could then return an A record pointing to

Ah, gotcha. Sure, the .COM registry could return NS records for example.com pointing to a controlled name server that could then return an A record pointing to a controlled web server that wasn't mine. And those false NS records could be modified by the registry (unlikely in the case of .COM but could conceivably be for a ccTLD) or more likely the registrar (after a compromise there).