All in all it’s just another turd on the wall

I don’t know if there’s any legal implications, but morally it’s pretty abhorrent. The question I’d be asking is would you even want to work for a company that engages in that type of tactic, especially since they’re likely to repeat that kind of nonsense after you’ve started the job.

Whilst I agree on the glue records, DNSSEC is most definitely included as standard (check my domain itsg.host which is on a free account)