They don't plan on collecting URLs, just (eTLD+1). The only real issue I can see here are users who have registered their own domain under an eTLD, and have it set to their home page.
Doesn't the differential privacy system described above prevent even that from being an issue?