Doesn’t that undermine what a NIP05 is supposed to be?
The authority of tying a domain name to your handle was undermined almost instantly. This is just another example.
No it doesn't. Nip05 is about trusting a domain, and human readable id. If you don't trust that username.npub.pro that's ok, you don't have to.
How can one trust a domain when literally anyone can create a subdomain on it to use for “verification”.