The people that make this sort of mistake should not be responsible for a TLD. This is one of the worst possible blunders imaginable.

Considering they control the .io TLD these should have been registered and locked as reserved. That this wasn't the policy is but one of the many failings that lead to this outcome.

If I were ICANN I'd slap them with a huge fine to send a message.