The biggest concern I've seen over the .io TLD is that it's the ccTLD for a territory ("British Indian Ocean Territory") whose existence / sovereignty is fragile. The people who originally lived in this territory were forcibly expelled in the 1970s – https://en.wikipedia.org/wiki/Expulsion_of_the_Chagossians – so there are problems from two points of view: ethically this doesn't sit right with a lot of folks, but even from a pragmatic point of view, the UNGA adopted a resolution in 2019 specifying that the UK should withdraw its administration from the territory – this has not yet occurred, and it is uncertain what could/would happen with the ccTLD if or when it does.