All domains are pretty much rented... I know it's more fragile with cc-tld's but really, given the corporate interests behind other TLDs and the use of trademarks to re-settle established lands, so to speak... I wouldn't trust any domain to always exist.

That said, despite it being in a position where it would have normally disappeared, I don't think .io is going anywhere... there's way too much interest in keeping it around. I'd go so far as to suggest that maybe it should become "not" a "cc-tld" despite it being two characters and having it's origins in a national definition.

Compared to some other cc TLDs (like .ly, .ga) that are used for domain hacks, at least the ones for the BoTs (.sh, .ai, etc) are politically stable.