It’s not that you change the passwords for each website often, it’s that you use a different password for each site. That way if one site gets hacked and your password is leaked, it can’t be used to access your accounts on other sites.

The upside of IANA doing it would be a standardised place for sites to move to. Without coordination, different sites would move to different TLDs, probably mostly based on what isn’t already registered. IANA could create a new TLD for this and give existing whatever.io owners a chance to register whatever.iox before its generally available