What could go wrong using tlds that were not explicitly reserved for internal use?

Beside the fact that was standard or not it made sense to use .lan domain for local devices, and a lot of router sold were configured with that domain for resolving local network hosts.

To me is a very bad idea to implement this proposal, it should instead be standardized and reserved for internal usage as a fix. There were even RFC like https://www.rfc-editor.org/info/rfc6762/#appendix-G that suggested their usage for local devices in a network.

What is the point of selling the .lan domain, except for making money at the expense of a security risk for millions of networks that already use that domain for internal hosts?

BTW to me there was never any sense to add new TLD domain despite country code. They decided to render internet less secure, by giving scammers infinite TLD to register they scam domain like "apple.lan", with the sole purpose of making for them easy money.

This has been widely used since before there were any TLDs explicitly reserved for internal use.

not putting lan in the most recent update to the reserved private namespace was a massive miss. It is defacto a reserved private namespace.