So if I type bankofamerica.com, does ENS respond with DNS controlled by whoever purchased it on the chain, or does it first lookup at verisign's root before going to ENS?
You can't purchase .com domains on ENS, only import them by providing a DNSSEC-based proof of ownership. This doesn't solve any of the problems with TLDs (ENS won't prevent the TLD operator from taking away your domain) so to get the benefits you have to use a ENS-centric domain like .eth