It's not a full recursive lookup: you don't understand how DNSSEC works. I'm not replying to you any more.

Not true, RFC4035 says all security aware resolvers SHOULD verify the signatures. It's far from pointless when actually implemented. Don't dismiss a whole protocol just because some historical implementations have been half assed.

No, it's experimental. But I run it on all my machines, the only time I've had a problem is when it caught a typo in a DS record.

It's not necessarily equivalent to a recursive lookup, you can ask a cache for all the answers because you already know the root keys a priori. But yes, it does follow the entire chain of trust, that's the entire point of dnssec: if you don't do that the whole exercise is utterly pointless.

No, modern resolvers like systemd-resolved actually check the dnssec signatures on the client.

DNSSEC prevents that if set up properly.