Yes. Look up the history of .sucks

The first reason https://get.sucks mentions why you might want one of their domains is to protect your brand online.

"protect" aka good old mafia-style "protection money" rackets.

No, they can use their trademark to take control of the domain without paying any money through UDRP.

That’s not how trademark law works, at least. Does the URDP really let trademark holders take down sites that are critical of them?

I wouldn't expect UDRP to allow a trademark holder to take down a site critical of the holder; I that's a legitimate use of the trademark, even if it's not approved or desired.

However, that's not really what most companies are worried about, they're worried about phishing or scams or misleading sites with their name; UDRP should allow those to be taken down fairly easily, although the question is always if it's less expensive to register the domain or to leave it unregistered and dispute it if it's misused.

Yes, a company by the name of Donuts did this with over 200 new TLDs.