Yup, you are missing something. In order for a name to be assigned, it needs name servers. If you ask for the name servers of any of the nonregistered domain names that VeriSign now "serves" with SiteFinder, they have no NS records.

If you squint hard, yes, this is "owning" the domain names, but only if you ignore the definitions set down in the standards. VeriSign carefully followed the standards (to the point of even putting an actual wildcard record in the zone files).

All VeriSign is doing is (a) breaking the assumptions that the world makes about TLDs, and (b) proving that ICANN is unable to act effectively (or at all!) when it obviously should be.