systemd-resolved accepts records of DNSSEC-signed domains even when they have no signature, allowing man-in-the-middles (or the upstream DNS resolver) to manipulate records.
I think in rhel we need to document that the dnssec validation in systemd-resolved is not the validation that you expect. Basically, the behaviour is good to, for example show a semaphore in a browser that will say validated/no clue/wrong when you use resolved dbus API. For more traditional uses, it is unusable. Maybe with DNSOverTLS you would be fine. Also, we can create an insight rule to warn about this.