It looks like the TLD was sold off to a private business by the Internet Assigned Numbers Authority in 1997, with those rights subsequently being sold on to other corporations.

The British government have issued an FOI response advising that they recieve no funds from .io domain registrations. The Chagos Islanders still don't benefit, but it looks like that'd need to be squared with a hedge fund rather than a government.

...It is weird that territorial domains can be auctioned off in the first place though.