To match the answer with the questions:

The expired-domain bidding services keep it confidential, because they know what you point out about tipping-off the owner. Their business wouldn't work if they didn't keep it quiet.

I expect people did used to write to the registrars to ask to be put on a waiting list, which may be what gave 'em the idea to make money at it. Money on the table = they won't give you the time of day if you just ask to be put on a waiting list.

The registrars used to operate like phone companies and release the names back into the wild. That was the above-board way to do it, fair to everybody, but of course once they figured out they could squeeze extra money out of playing off people in an auction, there was no going back. It's hard to say for sure, but I think that some major registrars only release names that they think aren't worth anything, but hold on to the better ones to get a higher price. If they release the name all they can get is $8.95 or whatever from the next owner, but if they keep ownership, they can force you to pay more to buy it from them.

What can I say? Once upon a time, in the Internet's days of innocence, domain name registration was just a public service, part of the Net infrastructure. Once they sold off the franchise to a private company, we saw the usual fruits of privatization, greed leading to pushing the ethical boundaries, and judging by the occasional lawsuit against registrars and associated agencies, crossing the line into outright crime from time to time. And so it goes.