1) No, you don't need alternate TLDs or mis-spellings.

The exception is if you're a bank, you might want to monitor those.

2) The .io TLD in the past was mismanaged, and has been pwned by security researchers. I don't consider it secure enough for SaaS use, and I won't signup for business services with companies that use it.