It doesn't matter if you can MITM someone through the DNS. Stipulate that it's trivial to do that. You still can't get in the middle of my SSH connection, because SSH authenticates itself, bidirectionally.
In that case, DNSSEC probably isn't doing much for you (besides the systemic effects of discouraging providers from returning false DNS results in the first place), but sadly not everything on the internet is so well-designed as ssh. Being unable to specify a port in MX records, leaving SMTP on port 25 with only STARTTLS for encryption being one good example.
> Most providers these days (including OpenDNS) redirect invalid queries to their own landing pages
OpenDNS stopped doing this on June 6 2014:
OpenDNS could still turn ads on again at any time. And the censorship and subversion arguments are still valid.
But often the provider resolving the query is itself untrustworthy. Most providers these days (including OpenDNS) redirect invalid queries to their own landing pages (which poisons caches and has other bad effects). Providers may "censor" certain domains. Or be subverted by state-level actors (see: Belgacom). In DNSSEC, the root of trust is the administrator of the DNS root zone (e.g., Verisign, whom you're probably already trusting anyway).
[1] But encryption is not a panacea. As soon as you visit the address(es) returned, someone will get a pretty good idea what you looked up.