Browser vendors have instituted a variety of different rules for this problem, include at least:
1. Decide (policy, enacted by humans) for each TLD if its registry has rules that will prevent abuse, if so whitelist this TLD and show IDNs as text for this TLD, everything else is punycode.
2. Algorithmically detect "confusing" IDNs and show punycode instead for those.
What’s next, emoji in stock symbols? Might as well...