The peer comments here aren't quite right. The query that goes to the root server, isn't "what's the name server for .com?". It's "what's the IP for abc.example.com?"

The root servers choose to send referrals back for the TLD.

They don't have to. They could answer the query directly, or send a bogus authority record for "example.com", etc.

So, technically, you could create some chaos in the way you're describing if you ran a root server. (Plus the wrinkle of DNSSEC).

How would this even work? Don't the root servers just help you find TLDs? To take down example.com, they'd have to take down .com, right?

If that's their goal (I don't think it is), they are hilariously incompetent at it, as the root servers do not have anything to do with invidiual domain names at all. They only map TLDs to nameservers.