This seems like bullshit given certificate pinning and other countermeasures here. What am I missing ?

Is it TLDs lacking support for this?