The reason DJI won’t do any of that is because they simply don’t care.
If they did, they’d start with validating email addresses when accts are created. Nope - they don’t even do that.
So if a user creates an account and login with a false email address, and binds the drone to it, that drone...