Well, almost all of them are ultimately controlled by the nations, but there are quite a few that private companies operate because they've paid the nation to gain control.
But then there's .io (and a few others: .ac, and previously .sh, .tm) where they were actually delegated to a British guy and are now controlled by the private company he started. And according to the British government, they have no agreement with the company, and they receive no revenue from the domain registrations.
2 letter TLDs/country-code TLDs, are determined by ISO 3166-1 alpha-2 country codes, and having a country code doesn't necessarily mean a country or a state.
There are a bunch on there that I wouldn't consider states, e.g. both UN/EU are exceptionally reserved and have `.un` and `.eu`. Antarctica also has `.aq`.
The Heard Island and McDonald Islands has `.hm`, and it's not a state (since it has no population) but I guess it is controlled by Australia.