Many ways of adding friction to obtaining the updatable value - which a human owning a domain would be happy to do, but a squatter would not want to.
that's how one of my local companies tries to force clients in. They removed auth code from their web panels and introduced complex snail-mail procedure.
That was clear signal to run, but it took me 6 months to do just the domain transfer.