Except this isn't even a vulnerability, this is expected behavior given the design I think, to encounter an issue with it, you'd need to leave your domain with DO's nameservers, but delete it from your account. This would only happen if it's something you're not using anymore, or if you're a severely terrible admin.

> this isn't even a vulnerability, this is expected behavior given the design

Those aren't mutually exclusive. It's certainly possible to be broken by design.

> This would only happen if it's something you're not using anymore

From the writeup it seems like it would also happen if you registered a new domain and assigned the DO name-servers but didn't immediately point it to something.

Typically when registering a new domain you add it on your panel first and then change the NS as instructed. If you didn't follow that order, well, that's on you. It's the same design just about everyone providing DNS uses (CloudFlare, XName, FreeDNS, probably others).

But DO instructs you to do it in the reverse order: https://www.digitalocean.com/community/tutorials/how-to-set-...

That's a community tutorial, however it does appear their panel is very sparse in instructions, when you add the domain you see a nameservers list. They don't even tell you that it's not pointed at them and that you should now configure your nameservers as other providers (like CloudFlare) do. I think you're right, some improved documentation would definitely be good here.

However it's the way I've always done it, because otherwise somebody else could add the domain first... it just made sense to me I guess.