In this situation, Cursor did not make any reasonable attempts to check this extension really was from anthropic.

So for the analogy, it really is like Costco didn't make any attempt to check they were buying actual iPhones.

A better analogy would be to say Anthropic must register their domain with every TLD available, to prevent someone cybersquatting it. I see Claude.org.nz is available.