Developer editions and sandboxes do not use the same domain names as production orgs. This means there is never any conflict between a developer org and a production org domain name. For example, if I logged in to one of my numerous developer orgs and tried to register "microsoft" as my domain, it would end up being "microsoft-dev-ed--msft.my.salesforce.com" instead (or something like that).
Sandboxes can't take on a different domain name from production, and are similarly mangled by the system during the registration process. For example, if my production org was contoso.my.salesforce.com, the sandbox would take on a name like contoso--mysandbox.cs21.my.salesforce.com.
So, if you wanted to "squat" on a domain name, you could--you just need to sign a one year contract and pay hundreds of dollars (minimum), per org, to register a new production org. There is a minimum level of investment required just for the purpose of registering a My Domain that could potentially be used by someone else.
Overall, this would be fairly useless, because My Domain is of limited use outside of Salesforce users. You use it for Lightning, Single Sign On, and the like. Similarly, the Site.com Terms and Conditions has a clause that prohibits you from squatting on a potential force.com site that would be misleading:
Disabling of Domains After Publication. If, after You have submitted a
domain or force.com subdomain and we have published it or associated
it with a Force.com Site, We determine in Our sole discretion that it
violates these Terms or the Master Subscription Agreement, or if We
receive a notice or claim alleging that any such domain or subdomain
violates or infringes any law or third-party right, We may disable the
associated URL and Force.com Sites and make reactivation of those
Force.com Sites conditional on Your submitting a new domain or
subdomain acceptable to Us. We reserve these rights irrespective of
whether or not ICANN requires You to cease using a domain.
In other words, people that are misbehaving may have their domain taken away from them.
As a more direct answer to your question, while you yourself cannot disable or change your domain name, Customer Support can do this for you, as mentioned in this help topic:
After you deploy your domain, it’s activated immediately, and requests
with the original URL are redirected to your new domain. Only
Salesforce Customer Support can disable or change your domain name
after it’s deployed.
This probably involves some hoops to jump through, but the general idea is that there is a process in place, because administrators can, and do, make mistakes.
I suppose one could go through the necessary hoops to try and protect their brand, but there generally isn't a need to do so, because it's not cost-effective to squat on a subdomain, and it can be taken from you at salesforce.com's discretion.