That is definitely true, it is risky and you have to trust your registrar. This has to be factored in when thinking of the threat model, or at least based on what are your goals and what the domain is for!