there is no nameserver.....

If you hosted through this method, it would be publicly visible, (like any web service) just only through the Nostr network, what service/application you are hosting, correct? (Also how do you do https without downloading and trusting a certificate? 🤔)

Only when the relay decides it, it can inject whatever it wants

Check out Cloudflare Zaraz; it injects the website with whatever content you like because they have the domain with them. (The NS) Similarly, Ad and tracking agencies dynamically insert ads into the website without ever touching their main code. It is https, but the certificate is not yours, and neither the origin server, they can insert whatever they like.