I don't really have much pity for someone who goes to google.xxx expecting google.com for porn and becoming infested with malware. The risk of BigCo not owning their domains in all possible TLDs is from phishing targets on their potential customers, email attacks. Apart from that, it seems really unlikely that target.xxx would outrank target.com in a search, so target.xxx would never be visited aside from idiots thinking it's Target With Porn or clicking an email link. So if the TLDs are a scam, the BigCos that play along are willing suckers.