The argument seems to be that if your attacker is stupid enough to only change your NS records and doesn't know about DS records, then DNSSEC will provide some protection.

It is not clear with ICANN mentions this, because somebody hacking your registry account (or somebody hacking your registry or the registrar) are attacks DNSSEC cannot protect against.