As Colm MacCárthaigh noted on Twitter, not only does DNSSEC not defend against the most likely and damaging DNS attacks (hijacking between clients and servers, and hijacking at the registrar), it actually makes things worse: an attacker who has achieved the vantage point these attackers have can use DNSSEC to semipermanently poison records by using it to sign high-TTL records.

It's not my claim that DNSSEC is what enabled this attack in the first place. But there's no way I'm going to leave the irony of USG agencies laboriously configuring their security-theater DNSSEC protocol while not being able to defend their registrar accounts or get basic MFA deployed.