AFAIK that only works if the domain's used in "bad faith", whatever that means. Considering that there are gTLDs that literally intended for criticizing companies (eg. .gripe and .sucks), I'd say he's fine.

edit: read a few lines down on the wikipedia article and it says the factors for determining bad faith are:

> Whether the registrant registered the domain name primarily for the purpose of selling, renting, or otherwise transferring the domain name registration to the complainant who is the owner of the trademark or service mark;

> Whether the registrant registered the domain name to prevent the owner of the trademark or service mark from reflecting the mark in a corresponding domain name, if the domain name owner has engaged in a pattern of such conduct; and

> Whether the registrant registered the domain name primarily for the purpose of disrupting the business of a competitor; or

> Whether by using the domain name, the registrant has intentionally attempted to attract, for commercial gain, internet users to the registrant's website, by creating a likelihood of confusion with the complainant's mark.

I think he should be fine