The difference between the British Indian Ocean Territory and say, American Samoa is that, as far as the BIOT government is concerned, there is no permanent population there. Obviously the US military base can just use .mil. So if ccTLDs are limited to locals, nobody is entitled to .io at all.

The Chagossians do exist, and I'm not trying to diminish their claims. But my understanding is that they claim the islands as a part of Mauritius, which also has its own domain name (.mu), and wouldn't identify with the colonial BIOT government that expelled them in any case.