The renewal vector is the only way atm, yes. But it's easy to prevent this as a .eth holder: just register for a really long time. Costs like $500 to register for 100 years for most names.

As for the controller bit, even if you change the controller, we can't revoke the .eth names. We can only change new registration parameters (as you mention).