Each TLD gets to set its own rules for name registration under that TLD. In particular they all have punycode policies. For example a country which uses a Latin alphabet with a handful of extra characters might requires names under its ccTLD to be from that alphabet, and not, for example, Cyrillic. Or a TLD operated on behalf of a region dominated by one writing system might require names to use that writing system. The attention of TLD registry operators was drawn to the need to prevent the exact types of fraud we're seeing here.

The .com TLD registry's priority is profit at any cost. A crook's money is just as good as anybody else's, right?