There is no perfect solution of course, but generally speaking ORG domains have been used to signal that you are an organization vs. a corporation, and potentially a non-profit.
That said, just like in the real world, individuals are encouraged to do their research and confirm that one is what they claim to be (just like door-to-door charity workers) before engaging.
this is the convention, but I don't think it's ever been enforced by the registrar. see questions 5, 7, and 8 on this archived faq: https://archive.is/20120716084313/http://pir.org/get/faq/gen...
what I'm getting at is: if ICANN never enforced the convention in the first place, and they are selling it to someone else who also doesn't intend to enforce it, what should I expect to change?
when it comes to security in particular, conventions that are usually (but not always) followed are often worse than having no convention at all. it sets dangerous expectations for lay people.
I think the biggest concern with this sale is around pricing more than "correctness of use", where I agree with you the ship has long sailed.
Selling PIR to a for-profit company, a private equity firm no less, means you can pretty much 100% guarantee that in the future pricing would be increasingly profit-driven.
with the possible exception of .gov (and local equivalents), people should not be encouraged to use TLDs as a positive signal of credibility. imo, the only things that matter are that domain should point to the expected entity (eg, wellsfargo.com points to the bank, not a phishing site) and that disputes over who gets to use a specific domain get handled in a reasonable way.