Managing DNS through DigitalOcean (although, this should be possible with any DNS service) requires both pointing the nameservers to that service and adding the domain to your account. If you delete the domain from your account, like I had, but forget to update the nameservers with your registrar, anyone else can claim the domain. Theoretically, if you redirect the nameservers first and then add the domain to your account, someone could swipe it from you, I guess. Though it would basically have to be pure luck.

Why is it always slot machines though?

By the way, even while a custom domain is still pending verification, the GitHub Pages LB will route the request based on the Host header, allowing for the following:

    dig +short github.io | head -1
    185.199.108.153

    curl -H "Host: 42.news.ycombinator.com" 185.199.109.153
    hello

Don't point a wildcard domain to Github. It's a wildcard and dangerous.

edit: apparently CNAME can't be used for TLD+1, only for subdomains, so you have to use a more error prone approach for those.

I would say probably 10 years, I remember reading about the CNAME github issue around 2015 or so, as before that most used to use jekyll with gh pages, was very popular among indie developers

I think this is the expected outcome.

It's good you noticed and shared your findings, but to me this "works as intended"

You didn't think through the consequences, and you could learn a bit more about DNS.