They could certainly say “we’re giving up on alpha-2 codes, new countries only get alpha-3 codes”. But it’d be rather difficult, as there’s a
lot of software using alpha-2 codes. I imagine ISO and ICANN would talk, and maybe ISO 3166/MA would reserve any extant three-letter TLDs, so ICANN say “no new three-letter TLDs except for new countries”. That’d solve the issue entirely.
https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2
https://en.wikipedia.org/wiki/ISO_3166-1_alpha-3