Note: they "stopped phishing" by basically forbidding almost anyone from registering a domain, I've been trying to get a new domain there for months without success
This is the real answer, I have a paid domain and am still unable to get contact or transfer off (I have attempted this with all known registrars that support .tk, Freenom simply fails to respond to the transfer request)
I mean that's basically the point. The barrier to entry of $10/yr and breaking anonymity is enough to price out bad actors.
If anyone at all has a way to combat this stuff that doesn't rely on "bad actors need disposable identities to get around blocks and don't usually have money" will basically win the internet.