Basically many domain providers will hold onto domains for a little while after it expires.

Some like namecheap also advertise the domain names to peddle-man companies that will somehow buy temporary access to the domain after your extortion recall window expires.

To continue the namecheap example, when your namecheap domain expires, it gives you a lapse window where you can pay like double the cost of the domain renewal to reclaim it. If you don’t reclaim it during that window they give it to a middleman whom will somehow buy a 2 or 3 months domain lease for it. They will put it on a “site for sale” broker page and will charge yo easily 100x what you paid for the domain if you wanted it back.