We pay for a bunch of old domains because nobody in the org can definitively say we never used it and/or don’t use it anymore.

Easier to just keep paying.

Not only have you stopped using it, but did any of your customers ever allow list it in the past? Great way to attack customers of some large businesses if you ever see it happen.

And if you don't squat some domains phishing could be a bit easier than otherwise.