The British Indian Ocean Territories (.io) might go to control of Mauritius. They will be able to decide what to do with the TLD. It could in principle be restricted to residents, or go away entirely.
If the UK loses control of it, I'd put most of my betting money on Option 3: The new owners extort everyone with a .io domain for a rate proportional to the perceived value. In other words, $50K a year for a successful tech company, $1000 a year for the average joe who doesn't want to lose control of a domain tied to 1,000 accounts.
I would occasionally check it, and the price would vary by hundreds of dollars, but never a price I was willing to pay. Eventually I think it lapsed again and was picked up by some Chinese site that (I think) was trying to sell massages.
Finally, in 2021, I guess they got tired of paying for it, and it fully lapsed, and I was able to purchase it, so I bought it for ten years.