Registrars can do pretty much whatever they want with an unclaimed domain. If the person doesn't pay, and they have already registered the domain, basically they "own" it.
You'll notice that they don't "hold" names like xyz-12334.net. It's almost always a more valuable domain.
Many registars now have a "used domain" sales page. Some of those on-hold domains may be found there.