If there is a flaw in the process, it's that you CAN add domains to your Apple ID that you don't own, as long as the domain's DNS settings point towards Apple. For example, I could change my domain's DNS records right now and, if I don't add it to my Apple ID, you can add it to yours. Usually, there would be an additional mandatory verification step such as adding a very specific TXT record into DNS.
Although... this may not be a flaw. Say that I have mysurname.com, and on it, email address for myself, my parents, and my nephews and nieces. They way it works with family sharing, if my parents are in my "Apple family" that's fine, we can all be shared and use the mysurname.com email, but my understanding was I couldn't with my nephews & nieces because they're not in my "Apple family". This setup, which lets you add any - I think - sounds like it would be a way to get around that limitation. My nephews/neices could just go through these steps to set it up for themselves. Or at least, sounds like it.