It's more the scenario that the country to which the company, or it's officers, belong/reside in, may take a disliking to their customers (perhaps for unlawful acts), and because the company is seen to own the domain, and either won't or can't hand over the details of the end customer, the company could be liable for those things.
Even if the company obeys every lawful direction on cancelling/handing over domains and whatever customer details they have - they may be seen as facilitating unlawful behavior, and so that in and of itself can be an unlawful act.
What? I was under the impression that this practice, although common in the past (especially with dodgy registrars), wasn’t even allowed anymore? I’m pretty sure that at least some TLD registries (like IIS for .se and .nu domains) disallow this practice completely, for good reasons.