They could ask very nicely for ownership of them, or perhaps send you a court order depending on what country the both of you were located in. But unless you provide them with the private key or fail to renew your registration... nobody should ever gain control of any .bit domain.
A Kraken.com dev looking into the namecoin code found a flaw and declared on the Namecoin blockchain that "Namecoin died October the 15th 2013, coinslayer" by re-writing the DNS values for the very first .bit domain ever registered (which is bitcoin.bit).
The flaw allowed for some people to "steal" domain ownership, but a patch was put through and everything is back to normal now. As far as I know, all domains are back in the hands of the original registrars.
This link shows the entire debacle taking place: http://explorer.namecoin.info/n/1
Who are they registered by?
Due to network effects, namecoin won't replace ICANN without making it better for all those organizations; and due to the core nature of namecoin, it won't be better for them.