I was curious about this, so for anyone else who’s interested, here’s a KrebsOnSecurity article from 2019 about how easy it was to fraudulently register a .gov domain:

https://krebsonsecurity.com/2019/11/its-way-too-easy-to-get-...

I haven’t seen any follow-up reporting, but it looks like the process now requires some semblance of identity verification:

https://get.gov/domains/before/