I'm surprised no-one mentioned Mark Monitor[0] (no affiliation). A lot of big brand corporations use it to protect their intellectual property. Can you imagine, for example, someone getting their hands on `apple.com` or `icloud.com`. They could wreak havoc since a lot of iDevices use those two domains in order to function and you could pwn many devices if you were determined enough. I imagine MM solves the 10-year time window problem by ensuring the domain lives well on into the future. It's what they do.
Yeah, and I checked a few whois history sites and the domain had been registered with Mark Monitor as the registrar. That's a major mistake on their [MarkMonitor's] part.
Edit: clarified that I meant the error seems to be on MM's side.
Companies hire MarkMonitor to safeguard their protected marks, which generally involves registering these marks under basically every TLD available. MarkMonitor themselves is an ICANN registrar so companies generally don't need to worry about renewals: MarkMonitor just handles it (how it actually gets billed back likely depends upon the contract).
So unless Google explicitly told MarkMonitor to release the domain, this seems like MarkMonitor dropped the ball.
Do large corps pay for their domain registration in small increments or buy up 10 year blocks at once? If you're Apple or AMZN or similar, paying upfront for 99 years won't exactly break the bank.
[0] https://www.markmonitor.com