Obviously the root DNS services work with a trust setting for certain secondary servers, once that trust is betrayed they can revoke that and it should prevent that from happening from that source and the fix would propagate at the speed of DNS, which is from immediate to 48 hours depending on your local DNS server settings.
The question is will they now start to look closer at whom they put in the trusted zone, and perhaps exclude nations run by dictators or religious zealots (excluding the US) from being in such a zone eh.
It was nice while it lasted I guess, hoping everything would be ok that is.

so 1 ISP can poison the DNS entries for any site? that's reassuring. anyone think that we need more that MS's phishing filter to protect us from this kind of thing?

is this Pakistan's way of telling the USA they're peeved?

Not quite.
Geert Wilders has only shown a trailer of a movie.
But frankly, nobody believes he actually makes a movie.
There is no prove of activity or anything.

Most dutch think he's just stirring up the world again, just like Hirshi Ali does all the time.