States being part of .gov is relatively new. There was a very long period where .gov was exclusively for the federal government. The state governments were under the domain (abbreviation of state).us, and everything was a subdomain of that.
Seems ripe for abuse if such registrations aren't being securely controlled
I was mostly trying to point out that registering under .us is pretty trivial. There is no need to try and sneak something into some states’s dns records, anyone can just go on any registrar and purchase something directly under .us