If four letter .com names drop, they're re-registered instantly.

There are thousands of four character .com names available though, and outside .com thousands of four letter domains, for example:

kfmw.net cwix.net wprd.net npyp.net vpol.net vrlx.net olfs.net ldti.net ufcc.net dgol.net [...] rbkd.org ytcu.org ohtf.org cjmn.org wgnn.org mjrb.org mafk.org cklw.org wegl.org ctnb.org

And available three characters are commonplace too, for example:

g0f.net j1c.net y1g.net x2z.net j2y.net o8x.net 2tq.net k8c.net 2g9.net c8p.net [...] 6o4.org k13.org 19f.org 2rd.org 2fo.org 3yu.org hh7.org ag4.org p-1.org 7de.org

There's at least one 4-character domain in the results (easier to find when you set max to 4), `xuci.org`. So they do drop.