These companies don't really "own" the names. They're paying $180k/yr for the privilege of ICANN delegating the responsibility of managing that gTLD to them. But this privilege isn't any kind of legal right; the company doesn't have a deed to or easement on that gTLD that would hold up in court. ICANN has just agreed, as their side of the contract, to 1. accept that company's zone-registration modifications vis-a-vis that gTLD; and 2. to not accept any other third-party entity's zone-registration modifications vis-a-vis the gTLD. But if ICANN don't like what's going on, they always have the right to just cancel the relationship (probably with a pro-rated refund for the rest of the contract period, but still) and then do what they like with the gTLD from there.

The thing I'd compare it most closely to, is an exclusive licensing of IP rights from a copyright-holder to another entity, where those rights include a sub-licensing right. While that contract pertains, the entity who licensed the rights can basically act as if they owned those rights; but the actual legal right-holder can always just revoke the licensing agreement — in the process, either "absorbing" the transitive license grants to themselves, anuling those transitive licenses, or finding a new contract-holder and transferring the "stewardship" of those transitive licenses to them.