NIP-05 isn't verification at all. It's an identity. If you read the spec, it doesn't mention verification at all, it only mentions identity. The issue here is that clients started using check marks and to users, check marks mean verified. Then, after a while, everyone started to treat NIP-05 as being verified. That's not the case though. All that is being verified is that a pubkey is tied to an identity on a specific domain. It's not a verification of anything beyond that. It's an identity, like an unique email address.