Abuse handling is a mess. AFAIK, the registries, registrars, and ICANN all share responsibility in terms of mitigation. There’s no consistency.