It seems to me that this can only be true if it's also impossible for the legitimate owner to change this. If it can be changed, then the 51% attacker can change it.

The actual DNS contains names with hugely long cache lifetimes and very little practical agility, and it also contains "fast flux" names whose RRs change constantly. If this experiment is only interested in the former it should highlight that, as a shortcoming.