> It could in principle be restricted to residents, or go away entirely.
If the UK loses control of it, I'd put most of my betting money on Option 3: The new owners extort everyone with a .io domain for a rate proportional to the perceived value. In other words, $50K a year for a successful tech company, $1000 a year for the average joe who doesn't want to lose control of a domain tied to 1,000 accounts.
I bought the tombert.com domain about eleven years ago, forgot to renew it, GoDaddy auctioned it off and a squatter sat on it, and they wanted $1800 for it back, which of course I wasn't going to pay for my dumb internet alias. I tried calling the squatter and offered to pay them $200, and they said that maybe they could setting for $1000, but this domain is in "really high demand" so they can't go lower than that.
I would occasionally check it, and the price would vary by hundreds of dollars, but never a price I was willing to pay. Eventually I think it lapsed again and was picked up by some Chinese site that (I think) was trying to sell massages.
Finally, in 2021, I guess they got tired of paying for it, and it fully lapsed, and I was able to purchase it, so I bought it for ten years.
The average Joe with an io domain is probably a developer happier to code up a migration than be extorted so dearly.