2.12 Can a New gTLD name be 2 letters?
Applied-for gTLD strings in ASCII must be composed of three or more visually distinct characters. Two-character ASCII strings are not permitted, to avoid conflicting with current and future country-codes based on the ISO 3166-1 standard.
Either way a policy change is needed.
https://www.tandfonline.com/doi/full/10.1080/23738871.2023.2238723
While I agree with you in that ICANN will probably save .io through some policy change it isn’t as easy as just saying “screw all our policies, this ccTLD is now a gTLD.” considering the fighting going on regarding it.