It does. And it should be a legitimate concern for any startup that is hoping to rely strictly on a .io domain. The story of the vb.ly link shortener - and their seized domain - is worth reading:

http://techyum.com/2010/10/official-vb-ly-link-shortener-sei...