Is it possible there's something in the ICANN registrar policies that requires them to do so?

If not, isn't this sort of suit how you'd get a court to issue such an order?

It appears there is:

https://www.icann.org/resources/pages/approved-with-specs-20...

See section 3.7.7.3

I'll bet that clause was intended to apply to law enforcement, but as worded (IANAL) it appears to say that literally anyone could send a registrar proof of "reasonable evidence of harm", and they're liable unless they turn it over. Very odd.