Why does namecoin have the redundant name_firstupdate step?
The reason is to prevent frontrunning: When a victim registers abc.com, the attacker might notice the TXN with the name_new abc.com request on Namecoin's P2P network. Then, he might issue the same request but with a higher TXN fee, and "steal" the domain from the victim, who was trying to register.

The solution is simple:


Rather than sending name_new abc.com requests that reveal the domain, send a name_new SHA256(r, 'abc.com') request that commits to the domain without revealing it. This way, an attacker learns nothing about what domain is being registered.
Reveal the domain later using a name_firstupdate r, abc.com request which reveals the domain, preventing people from stealing it. By this point, the attacker can do nothing because abc.com has already been assigned ownership using the name_new request.