Yeah. The article explains whether the IANA rules come from, but this kind of thing happens so rarely that frankly it should be handled on a case by case basis, and in this case the .io domain should just be straight up reassigned to the people that it should always have been assigned to.