Earlier quoted context omitted.
It's an interesting flavor of "No True Scotsman" when you've managed to argue that every resolver on every OS in the world is "stupid stuff that isn't DNSSEC". If DNSSEC only works if you're using a custom fully-recursing resolver, not present on any mainstream operating system or built into a single piece of software you install on your machine, what exactly is the point of signing a zone? So far as you're concerned…
DNSSEC has a very clear specification a few widespread implementations. What you are talking about fit to those? Are you really making FUD about it, by claiming unrelated logical fallacies in a non-boolean discussion? How does a "no true Scotsman" even applies to something that has a published standard? I know you don't like it, yet, I have never seen any proposal that brings you the assurances DNSSEC brings. AFAIK,…
DNSSEC defines stub resolvers, both validating and non-validating. Validating stub resolvers do their own supplemental recursive lookups to confirm DNSSEC validation. Non-validating stub resolvers do not: they strictly determine DNSSEC trust by checking for the "ad" header bit in the response from their upstream recursive resolver.
Every operating system, Linux distribution, and application that I'm aware of defaults to having a non-validating stub resolver (if it enables DNSSEC validation at all). This renders DNSSEC validation as performed by the overwhelming majority of systems vulnerable to the risk we're flagging here.