That makes the most sense to me. Although, I don't know if .org is subject to US law specifically? Is it?
PIR, the registry of .org is an US company, so clearly subject to US laws and Trump's explosions.
The .it in the past forced you to have public whois data, this changed in recent years thanks to GDPR.
Probably they chose .org when they created the organization at the time.