So the phisher registers a new domain, gets the real authentication e-mail, alters it to insert a malicious payload of some sort, then mails the altered copies to the marks. The validation e-mail notices may be triggered by events that are not verifiable by the customer, so if one shows up out of the blue, you have no way of knowing whether the registrar got a bounce from temporary network congestion or whether some phisher got your unredacted WHOIS record.

No matter what the registrar does, the phisher can obtain and alter a copy of it.

The only way to stop the phisher is to inconvenience the customer in a much more annoying way. The registrar could remove all hardpoints to which any phisher could attach his payload, such as by omitting phone numbers, clickable links, scripts, or customer-identifying information. That leaves, "Contact your registrar as soon as you are able, or your domain may be disabled within 15 days."

Anything that anyone does to make the validation process easier could be hijacked to put the customer in the phisher's false reality.