At the protocol level, any account can verify any other account. If you have one, you can verify anyone you'd like right now. The NYT can verify any account, even ones from those organizations, or not even from a news organization.

The only difference is that Bluesky won't show a blue check for just any verification, only ones from accounts they trust. That's a social relationship, not a technical one, and so I'm sure if the NYT decided to go rogue, Bluesky would have them not be an input into the blue check any more.