Absolutely this is a problem. Its in the same vein of problem as people getting usernames close to famous peoples on twitter, buying a bluecheck, and impersonating them.

But if I buy and validate therealslimshady.comslimshady.com, wouldn’t the fact that there’s are different DIDs associated with the two txt records be a red flag?

The other half of the solution here is community labeling. Someone (who is trusted by people) can create a label for 'active US government officials' and apply that to accounts they have double checked as being real. We can have composable layers of security here