Did you verify the actual payment processed by the merchant processor, or just the category it fell in and the price of that category when the domain was actually registered?
Bad code happens, the Google Cloud Print DDoS fiasco is but one example.
Why is a decade needed? The forum.dev domain name in question was registered a year ago on 2021-12-06...
Of course, but it’s pretty hard to jack up prices before the product was launched, which gp was weirdly adamant about.