Loaning or renting (registering) amount to the same thing for the purposes of the the public suffix list: because the *public* can create entries under github.io, you cannot assume that alice.github.io and eve.github.io are controlled by the same entity, so you should not share alice.github.io's data (e.g. cookies) with eve.github.io.

There is no formal ICANN TLD list. The PSL is your best shot. So it is actually wrong to assume that your situation is the sole purpose.

For instance, https://data.iana.org/TLD/tlds-alpha-by-domain.txt

Where is .co.uk ? That is - for all intents and purposes - considered a TLD.

So PSL is currently doing double-duty and the distinction is very important.