How are they getting through the security of the true hosts to the existing sub and similar-sounding domains, just because another ISP lists them as alternate options that 'you may also be interested in'?

If you're a domain jacker you'd already know how to get lists of similar names that are free, and find out unused sub domain names.

It makes it sound like they found a way to get the ISP listing the sites to host (or redirect to) jacked versions of them? In that case, only the ISP doing the listing is insecure, not the actual real sites.

But then if you mistyped a real site, and were taken to a page of alt options to it, you might actually then notice you'd mistyped it. Would you really go visit the alt options, and continue to not notice none of them were the site you were originally after.

Unused domains, is a different story. Using those isn't threatening any security directly.

Or is this more about users being directed to visit dodgy sites - which again, isn't a threat to internet security directly (anymore than visiting any other dodgy site is).

I think we all agree, that we don't wan't to see addsites when we accidently mistyped a url. In most cases they don't offer right what you search for but what they want to sell to you. I sometimes loose some seconds of my onlineexperience because i took some of these sites for real websites and did not realize my mistake. I like Error messages more.

Well, they cannot send you to a Spamsite when the domain you typed isn't even registered. Its only possible when the domains are explicitely registered or if soem subdomains are not used. In both cases the Owner of the correct domain can do something against if. He could either warn the provider who registered the mispelling or sue him. And with every domain he has he should use a dnstag with widlcards, that lets every subdomain translate to his mainsite. If he cannot control the dns tags via a domainrobot, he can call his Provider to do so.
Every Owner of a website should do so to prevent exploitation of unused subdomains by the provider.

What a brilliant piece of reporting Nick!