Which is a shame really. I understand why they're doing it, it's stressful as hell to configure, since if you do it really wrong you might as well just write off your domain name, but the extra assurance was nice.
Not only it is stressful to configure, it can be used to hold your domain at ransom.
IMO browsers should just use TLSA records instead. They already starting to use DoH, so DNS is secure even without DNSSEC.
It's less bad, but far from secure seeing it is not end-to-end encrypted.
A simple solution is just to forbid http altogether. No properly encrypted HTTPS connection - no website, sorry (unless you downloaded some kind of firefox developer build). But we're not there yet.