So the .su domain was handed to Russia to operate alongside its own (.ru). The Russian government agreed that it would eventually be shut down, but no clear rules around its governance or when that should happen were defined.

But ambiguity is the worst thing for a top-level domain. Unknowingly, this decision created an environment in which .su became a digital wild west. Today, it is a barely policed top-level domain, a plausibly deniable home for Russian dark ops and a place where supremacist content and cyber-crime have found cover.

I seems IANA would like to not repeat past mistakes.

Yes but it’s unregulated and like most unregulated TLDs it has become a cesspool of malware and dark dealings. I don’t think anybody would never if that were to happen to .io.