There is definitely a security issue that stems from a provider allowing the registration of almost identical email addresses. But it's not quite the one that your specific examples are testing. And its effects aren't even necessarily limited to users of the email service, but can more broadly impact anyone receiving mail from a user that service. The danger I'm talking about is one that involves impersonation of a user of the service to mail recipients.
To see what I mean, let's first set aside the confounding issues (already well discussed) of what is and is not a valid mail address and whether a user's id is actually the same as the user's external email address. Instead, let's look at the following scenario:
Attacker wants to get malware implanted on Jane Smith's computer. Attacker knows Jane Smith's email address, knows that Jane Smith is close friends with John Anderson, and knows that John Anderson maintains an active email address with a webmail provider mail.com at JohnAnderson@mail.com. Attacker checks mail.com's registration process, and happily discovers that the service will allow him to register firstname.lastname@example.org (no caps) as a valid address. Attacker sets his "from" name for the account as "John Anderson", and begins to compose a spearfishing email targeting Jane Smith. Attacker finds a PDF document on the internet that seems like the type of item that both John Anderson and Jane Smith might find mutually interesting, and then uses SET to insert into that document a PDF exploit and malicious payload.
Attacker sends the message. On Jane Smith's end, she receives an email from "John Anderson" at the address email@example.com. The message is one forwarding on a PDF article with a one sentence recommendation from John: "Just finished this, and think you'll find it worth a read. Not sure I agree with all of the author's points, but very, very interesting." And because mail.com cryptographically certifies that the message does in fact come from the purported address, Jane Smith's email service has let the message go through to her inbox instead of kicking it to the spam folder (as might happen if Attacker just simply spoofed the "from" address).
Rhetorical question: what are the odds that Jane Smith opens that PDF attachment?
Answer: about as high as you're going to get for a spearfishing attack. (At least without gaining access to email system of her employer and impersonating her boss, or something along those lines.)
The chances that a typical user is going to realize that JohnAnderson@mail.com, firstname.lastname@example.org, or even JAnderson@mail.com aren't the same sender are pretty low. (If the user is very security-aware in general, obviously the chances for detection go up. Though I suspect not as much as some might assume.) If the real email address of the real person that the attacker is trying to impersonate is already in the recipient's address book before the attacker's email arrives, the recipient might (might) when he/she receives the message notice that the sender of this particular message isn't in there, as the recipient would expect. And he or she might (might) find that a little suspicious. On the other hand, he or she will, more likely, just assume that the correspondent was emailing from a new, slightly-different address for some reason. Or that his/her email service's address book feature was being finicky. Or...
You get the point: This close-email-address impersonation tactic can be a very powerful (if sometimes overlooked) one in phishing/spearfishing attacks.
As to what email providers can do and are willing to do to try to bar very similar address registrations, it's a tough practice to effectively combat even if an email provider wants to. And considering that any given mail provider would prefer to tell registering potential users "Sorry, that address/user id is already taken." as few times as possible (if they get that message enough they might just give up and see if another email service one of their desired names free) the incentives for email services are to allow the registration of virtually any technically valid email address (with few exceptions).