Yes, I don't see how this MTA-STS avoids the DNS security issue. The system first uses a DNS TXT record to indicate a policy exists, then uses HTTPS to fetch that policy.