You’re correct. There are two key things.

1. Only one user can add a zone to the DO DNS control panel. Now that you’ve added your domain, no one else can. And you can’t gain control of the DNS for other people’s domains unless they’ve deleted the domain from the DO control panel while leaving it pointed to the DO nameservers at their registrar.

2. The assumption that, if someone else had added your domain under their account before you did, well, you wouldn’t choose to go to your registrar and give that person control of your DNS. That would be silly. You’d use a different DNS host, or contact DigitalOcean to complain.

Some DNS providers solve this problem by using a large number of different nameservers. For example, if you created a zone, and DigitalOcean told you to use ns792.digitalocean.com and ns481.digitalocean.com, but the domain was already using ns515.digitalocean.com and ns289.digitalocean.com and you were unable to change it, it would be obvious you didn’t control the domain.

Other DNS providers, like DigitalOcean, trust their users to behave responsibly. (While knowing that users don’t always do so.)

Edit: Additionally, while you or i or anyone can add any domain like google.com in the DNS control panel, it doesn’t matter because Google is not going to go to their registrar and change the domain to point at the DO nameservers. It doesn’t matter if you’re hosting a fake service if no one knows to use it.