It's up to the registrar to make the rules. If nic.io is fine with people outside of that territory to use their tld then it's okay.
Some TLDs do indeed have stronger requirements. I remember that for a long time getting a .fr was a bit of a pain because you had to prove that you were a french citizen or a french company IIRC.