Oh, it can. In fact there's an entire official tome of documentation describing how to carefully do Unicode-in-URLs to reduce the risk[0]. Browsers also have some mitigations to avoid the most common issues like homoglyph attacks where they show the domain in punycode if it doesn't match some local heuristic (like if you're in en-US, it's unlikely you're actually trying to visit a site with Cyrillic letter "a" instead of ASCII "a").

It's implemented because we have thousands of writing systems and we decided, for better or worse, we want to reflect those in URLs. Solving the subsequent security issues is likely easier than getting everyone to agree to read and write the same language.

[0]: https://www.unicode.org/reports/tr36/tr36-10.html