While the company’s new top-level domains could be used in phishing attacks, security researchers are divided on how big of a problem they really pose.