Furthermore, stuff that's common practice amongst squatters is expressly forbidden in other areas. At least in the US, you'd have a very difficult time trademarking an software company spelled "Microsoff", but typo-squatting is _rampant_.
There's a massively disproportionate amount of risk/reward for property speculation than there is for domain 'speculation'. If I find out about some new product coming to market and squat the domain - the company could potentially lose a huge amount of revenue, whereas I'm risking the cost of a latte.
In the end, any resource that is limited, underpriced and has some ability to produce income will get nailed by speculators sooner or later, and the price will rise.
Typo-squatting is of course unethical. I would not say that the practice is rampant. A recent report by Verisign showed that it is declining and really is not prevalent. It's also not very profitable. PPC revenue has hit rock bottom in recent years. Talk about risk.
There is risk it seems because there is a high learning curve for what a quality domain name is. If you watch the industry, research keywords and learn to evaluate domain names you can do very well.
As far as punishment, looking ACPA, 100k penalty for cybersquatting. That's taken out some of the biggest offenders (see IREIT).
I wish it weren't true - many times I've wanted a perfect domain to find it taken up by some loathesome spam page.