I'm wasn't talking about second level domains (though you're right that -where available- second level domains do widen the scope for TLD usage). But what I meant was that ICANN periodically releases new gTLDs for public use and even offers a program for companies to sponsor new gTLDs.
With regards to .io, technically that's a country code (ccTLD) that's been re-purposed as a gTLD by many organisations in recent years.
Most TLDs don't have any second-level requirements, and AFAIK .io has never had any.