I'm going off your post here.

1. I hijack the DNS entry so "_atproto.ruuuuu.de" TXT record now returns "did=did:web:iam.evilhacker.de" to the the actor doing the at protocol resolution.

2. To get the DID, the actor doing the at protocol resolution downloads the DID from "https://iam.evilhacker.de/.well-known/did.json", which I have full control over.

3. In the DID document, I put "alsoKnownAs": ["at://ruuuuu.de"], along with my own public key.

Wouldn't this make the actor doing the resolution associate me with your handle?

Again, maybe I'm missing something here. It just seemed to me this would allow me to hijack your posts when they are federated.