You shouldn't use the almost-scammers of GoDaddy as an example. Whenever I hear any Domain horror story it's about GoDaddy, it seems like a bad idea to extrapolate from them.
https://twitter.com/n
Apparently he's got his @N account back. I wonder how it happened, I don't see anything about it in the article.
Yes, my main domain is locked by the registry and transfer requires some form of state ID validation with the registry to unlock the domain, before a registrar can transfer the domain.
Should be good enough protection against social engineering targeting registrars.
Also is it only domain block and not ip block?
[0] https://medium.com/@N/how-i-lost-my-50-000-twitter-username-...