What's your point? If I put the non-punycode version in my ascii checker it immediately tells me it isn't ascii.

Having to check because registrars are dumb has nothing to do with the fact that doing the check is easy.

That's very true. Such attacks are predicated on an ignorant and/or lazy target demographic, I guess.

Incidentally, when I copied the link out of Chrome (57) it pasted the punycode link even though it showed "apple.com" in the omnibox. So then I carefully copy-pasted just the domain and TLD to work around Chrome's link-copying magic, submitted, and... discovered that Arc punycode-ifies Unicode domains.

So that was interesting, but it kind of killed the impact of the point I was making.

It doesn't, but you do have to do a manual check and remember to do that.