That's good in theory. The reality is that punycode never took off anywhere in the world.

Unless you're proposing we let it live in case someone somewhere ever uses it. Then, sure.

The software world is dominated by English language, especially American English.

It does make sense to permanently disable Punycode.

Each TLD gets to set its own rules for name registration under that TLD. In particular they all have punycode policies. For example a country which uses a Latin alphabet with a handful of extra characters might requires names under its ccTLD to be from that alphabet, and not, for example, Cyrillic. Or a TLD operated on behalf of a region dominated by one writing system might require names to use that writing system. The attention of TLD registry operators was drawn to the need to prevent the exact types of fraud we're seeing here.

The .com TLD registry's priority is profit at any cost. A crook's money is just as good as anybody else's, right?