Simple. Only the authoritative server matters.
I can set up DNS for google.com on my servers at home, and make it look like google, and fiddle with it all day long, redirect and capture traffic from my kids, etc. etc., but as long as clients are actually asking the root servers for the authority for the zone, it won't matter what I have set up...because the authoritative server determines this, and will return the correct address records back to the client.
Yes, you could create poisoned DNS entries and all that, but sooner or later, the TTL on those entries will expire, and unless you can directly control the client's resolver address, the client will run out to the root servers, the root servers will point them to the correct server (the authoritative server), and the jig's up. Even if you use another DNS service, that service will sooner or later cache the correct entries.
In the case of company B in your example, you can set up the records all you want. Unless clients query that server, it won't matter. If they do query it directly, then that's another matter, but even that won't last forever, and when the TTL expires, the DNS dance will happen all over again...directing them to the correct server.
The key here is the DNS server registered with the root. Whatever the root thinks is the IP address of the server(s) that are authoritative for your domain, well, that's where people will go to get answers. If you are concerned about someone hijacking the domain name while "in transit", that's something best resolved by using the tools provided by the DNS service to transfer the domain over. They will handle all of that for you. When they do, they will set up their service as the authority for your zone with the root servers.
If you are concerned about someone trying to register the domain again, then DNS is fundamentally horked, and the internet is borken (not broken, but BORKened). It just doesn't happen that way.