To clarify, I meant that from the devs' perspective: The effort of individually vetting every single character for possible confusion is immense, and the end result would still be just as western-centric. Imagine having a domain name in Greek where some characters are replaced because they might be confused for Latin characters. Or, conversely, having a few characters replaced by similar Latin ones for an attack, which your solution wouldn't catch.

The result would also still be unreliable even for Westerners. If some other character set you didn't vet also contains similar looking characters, there's a new surface for attack.

To properly close that security gap would be an immense arms race... or you could simply shut down the entire attack vector.

So when you consider the importance of protecting gullible people from insidious attacks and the complexity of trying to allow non-Latin characters without creating openings, the question "How widespread are non-Latin URLs in my target audience and is it critical that they be rendered in their native script?" becomes a calculation of cost and benefit.

It's a shit compromise to deal with the shit fact that some people being assholes ruins good things for the rest of us who aren't.