Lostgallifreyan wrote:

Because it happens at the TCP/IP stack level

Ok, but bear in mind that's still a file access, and that's one
of the slowest events in any machine.

Do you know how fast a typical computer can load and parse a 1-mb file -
vs the time it takes to perform even a single DNS query?

But even beyond that, the HOSTS file seems to get read only once per
client application.

For example, if I open an instance of FireFox, that instance will be
using what-ever version of the hosts file that existed at the time
firefox was started. If I edit or delete the hosts file while that
instance is running, it has no effect on that instance. Firefox
continues to operate as if the original hosts file is still present.
Even if I open more tabs and browse to new sites, the pre-existing hosts
file is still in effect. If I keep this instance of FF running and open
a new instance, the new instance will behave according to what-ever
changes I've made to the hosts file.

So it seems to be that each application has it's own version of the
hosts file cached for it somewhere in memory, which is loaded at the
time the application is started.

A hosts file may also be vulnerable to attack itself,

It's been known that malware will mess with the hosts file. But that
takes us back into the realm of Win-98 vs Win-NT in terms of malware
exposure and vulnerability - a realm where win-98 has always been
inherently superior (if only because of simplicity - or because of dumb
luck and not by design).