You're correct, very interesting. In summary, Daniel Negari paid $185k for the .xyz, purchased a few other gTLDs, and Alphabet supposedly only pays $9 per year for its domain. I presume Google is confident in xyz having no security breach and a good disaster recovery procedure ;)