.in is a ccTLD, so there are no requirements on its transfer process whatsoever. There are plenty of ccTLDs out there that don't use EPP at all, and simply maintain everything in a hand-edited database or provide a web console (but not programmatic interface). I doubt that .in is one of these ccTLDs that doesn't support EPP, because the big ones tend to support it for obvious scaling reasons, but there's still no protections being offered because the Indian government can always just do what it wants, like provide an API to an anti-botnet company in Germany that can instantly yank any domain name it wants to.