As I noted in my prior blog entry - Why is ICANN still running a server for .museum? - ICANN is running a TLD server on behalf of .museum.
I just checked and that server is providing wildcard-based replies for names in .museum, just like Versign's "sitefinder" does for .com.
In other words, ICANN is running a TLD server that does exactly what ICANN demands that Verisign stop doing.
Seems like a case of the pot calling the kettle black.
PS - you can repeat my experiment with the command:
dig @ns.icann.org.
dkdkdkdkkdd878787887878.museum