For those having a hard time fathoming it, here's a rather simple attack case:

someone types "product.zip" into the address bar thinking the browser will automatically google it because of course it's not a valid domain name

but it turns out product.zip is a valid domain name, and it masquerades either as the product's webpage or as a delivery vector for other payloads.

---

I've mistyped search terms with periods in them and seen the browser try to route me to an invalid domain, so this isn't beyond the realm of reason.

---

edit: xsmasher below came up with a much more obvious attack case that deserves a read.