Pricing, stability and security. As per usual.

What makes a domain registration unstable or insecure?

There are probably many valid answers to this, but my concern would be about bugs or other security failings allowing an attacker to alter one's registration details (e.g. nameservers). This could be catastrophic, since everyone seems to base their security on email (e.g. password resets) these days, in true "pass the hard problem of identity and authentication on to someone else" fashion.

In other words, whoever controls the registration controls the nameservers, and whoever controls the nameservers controls the MX records, and whoever controls the MX records can reset passwords. (Ideally, we'd all be using MFA for every possible thing, but in practice that may not be possible for the hundreds of services one might be using.)

I haven't noticed much, managing my own domains and some low traffic third parties. I have experience with namecheap, 101domains, gandi, godaddy, and others I can't remember from the top of my head. The most tangible for me is the web interface they give you - I like gandi's the most, and there are some shitty providers that don't even have one. Otherwise they are similar, they reserve the domain for you, let you set it up and provide nameservers so that you don't have to host those. Another difference is how much their website, and their renewal flow makes you hate life with all the dark patterns they employ. Godaddy and 101 were quite horrible in this regard, I really needed to double-check before paying that they haven't slipped in a value-add that I don't need, but would cost me nevertheless. Again, gandi is one of the better ones in this regard too.

Gandi also has a nice API to manage the domains. I use that with a simple shell script to have my own dynamic DNS.

So if your usage is as limited as mine, no major differences really.

Some have different DNS capabilities. For example, I switched from Epic to Hover and couldn’t properly set up a heroku app (can’t remember the details, but they were unable to support a basic heroku app setup). So then I switched to namecheap and it’s been fine (though I feel like a lot of my emails go to spam on hotmail/yahoo/aol accounts - which is perhaps another difference between providers: getting their email ips blacklisted).

Some registrars makes it difficult to leave, like having to actually to speak to a human on the phone to get a domain transfer authorized. That was my main gripe with my previous registrar.

In steady state, most registrars seem equivalent, and the main difference is how they handle billing.

I've been through registrar hell. I registered a ccTLD and wanted to transfer since the price was way lower elsewhere. Their CMS was complete garbage and the auto-generated transfer token/code was evidently bogus, as every registrar I attempted to transfer to said it wasn't right. Of course, the support from the registrar I was attempting to leave was nonexistent, always blaming the other guys. Yeah right, screw you TLD Registrar Solutions - avoid any of their brands at all costs. There's almost nothing you can do. My solution was to wait for domain expiry and re-register. Would recommend bigger names.