I think this is the relevant code:

    TLDS = "[a-z][a-z]+" 

https://github.com/arXiv/arxiv-base/blob/develop/arxiv/base/...

A more restrictive TLD list would have prevented this, but I certainly don't want to be the one to add new TLDs all the time, so I can see why the code looks like it does.