The entire publicsuffix thing is such a mess. The fact that project even exists is ridiculous. Why can this not be a dns setting?

One of the complications that gets discussed is that there are way too many use cases with different requirements on what it means for domains to be related. The cookie problem is something browsers need to solve, so its perhaps reasonable that Mozilla (and volunteers) manage a list that focuses on that user case. But that's poorly suited for other use cases.

There's a lot of people thinking about this though. One somewhat related example is https://datatracker.ietf.org/doc/draft-manelidis-dnsop-domai..., which has a double-opt-in DNS TXT record mechanism. That draft and forthcoming discussions on the mailing list are a good place to understand the complexities here.

because, like everything, bad guys would abuse it, causing a list of "bad publicsuffix" to exist, which is basically the same thing.