It proves they own or have some control over the domain, and hence the website. The NIP-05 ID is linked (and actually resides on a nostr.json file) on a webserver reachable via that domain - Thus you have th beginning of a chain of verifiability. But the verification ability goes further than that. https://b10c.me/.well-known/nostr.json?name=b10c - This is the link on their profile. You can get they're pubkey in hex format from here. npubs are usually read in the NIP-19 bech32 format, so if you take that that hex string and convert it into the NIP-19 bech32 format (many nostr pub key converters around) you'll get the npub address that's displayed on their nostr profile.