Not only is the agreement between the UK and Mauritius on the brink of collapsing (bizarrely, the UK is trying to get rid of territory and Mauritius doesn't particularly want it very much), but there's so much reliance on the .io domain that it's unlikely to be removed.
Especially because tech giants like Google, Microsoft, and Apple make use of it.
ICANN is pretty strict about this following some complications that happened back in the 90's . No country, no country code, no domain. No matter who, no matter what.
That would make it the only 2 letter non country code top level domain. And could also cause issues if another country is later assigned io as it's 2 letter country code by ISO
Though they have made odd decisions before. IO is generic and widely-used enough that it doesn't seem implausible that they might change it to not be tied to the Indian Ocean territories.