On a side, side note — Are those funky TLDs really widely supported/interpreted as links when not using http in main-stream apps (Mail or even browsers)?
Worse, everything.anything is now treated as a domain, leading to accidentally trying to browse when watching to search for dot separated programming terms such as libraries.
This happens on Twitter a lot. I've seen a lot of people referencing names of libraries, events, etc. and them being turned into links to URLs that don't exist. (.app is a common one for this.)
Twitter could try to resolve this domain first before formatting text as a link.
Accidental typos (better yet, missing space after a period) also triggers some clients to send HTTP requests to the pseudo-URL to build up a quick view, which sounds like a potential security problem.
It also happens, rather unfortunately, with my aging parents who love to sign off emails with 'xxx' and are often missing the space after the final period and ending word of the email. Some of the results are guaranteed risky clicks.