“Crucially, they all bypass the key security measures deployed by Chromium-based browsers.”
Two characters. That is all it takes to beat the spoofing checks in the browser most of the planet uses. Researchers registered oƙta.com and the address bar shrugged. Internationalized domains have been a phishing gift for twenty years, and the fix is still a blocklist of letters someone forgot.