With rigorous ID requirements, that restriction can be circumvented easily.

I think the problem is they domain sales are for-profit, there’s no incentive to prevent squatting as it’s presumably a huge profit centre.