Have you ever considered what it's like working on the side of the registrar
itself?
Believe me when I say it's NEVER easy, especially when trying to balance
accomodating customers' requests while maintaining the security of the
domain names themselves.
All it takes is just one determined hijacker to attempt to exploit a weakness
in a registrar's processes or a domain name's registration. If that happens,
it'll create problems no one wants to be in.
Not the registrar, not the registrant. No one wants those problems.
Been there, done that, don't want to go thru it but found the experience
worth learning.