As others have noted, otherwise legitimate DNS domains may be compromised and abused to serve malicious DNS records as subdomains. There is a service space in the underground economy for this, driven largely by the incredible success of credential theft from phishing campaigns, malware assisted password theft, or credential reuse over the years. Most registrars don't incentivize customers to use strong authentication options, and many don't offer MFA options. So as a result, the systemic abuse of hijacked DNS domain holder accounts for creating and controlling rogue A records, commonly termed domain shadowing, has been a thing since at least 2010.
Attackers do this because it's free DNS infrastructure, and it provides them with positive reputations and blacklist avoidance.
Food for thought: this weakness in domain trust affects other aspects as well. Consider an attacker that has hijacked a legitimate domain, created a rogue A record that points to a web server they control, and has also picked up a domain validation certificate for the malicious FQDN. Any visitor to the exploit kit, phishing page, or web skimmer operating on that malicious FQDN will get a positive validation from their web browser indicating the legitimacy of that site. It is in fact legitimate, from a domain validation perspective, because the entity saying they're in control of the DNS name (the attacker) is very much in control of it. The thumbs up from the browser, rooted in strong cryptographic models, is also compromised by the loss of a single set of weak or stolen credentials.
Additionally: the concept of big companies with security teams monitoring things being outside this threat model is shaky. It seems to have more to do with which registrar you use and what authentication and authorization controls you have in place for those services.