There's also the case when someone is googling "restaurants" and there happened to be a malicious http://restaurants. website.

if your internal systems where set up correctly that would not happen,. your local DNS should override any external records.

If I added an A record for google.com to bing.com's ip address on my internal dns no one would see google.com

Until your user takes the company laptop to the coffee shop.

Or another common scenario.

User takes laptop home and forgets to enable the company VPN.

In some intranets, users might be relying on mDNS (Bonjour) or WINS (SMB/CIFS) name resolution, rather than static DNS; both of those mechanisms, by default, get resolved at lower-priority than DNS (because they're quite slow, so you don't want your computer checking them first every time), so if there's a real DNS entry it'll get used.

mDNS is actually in the list FIRST in at least Ubuntu, check /etc/nsswitch.conf.

Linux's mDNS support is split into two parts--mDNS presence (which uses cached/recently broadcast-announced values), and mDNS resolution (which doesn't.) If you don't have a name cached, the first part won't know about it, so you'll hit DNS lookup before failing back to full mDNS resolution. Basically, it becomes a race condition of when you last brought the machine up.