Who or what gets to say what a valid TLD is? Especially when people take advantage of their own local resolvers, they could create anything at any time.

IANA maintains a list of TLDs in the root zone[0]. I presume browsers use this list, since it does cover all TLDs in >99% of situations.

[0]: https://data.iana.org/TLD/tlds-alpha-by-domain.txt

Yes but local/corporate DNS servers can use any TLD they want...

Right, but browsers don't automatically recognize those, as far as I know. If you want to visit a site with a custom TLD I believe you have to prefix it with the protocol.