The majority of the sub-ccTLDs and most gTLDs operate in an Sponsor/Owner-Operator model with each aspect being (largely) independant.
.beauty (formerly L'Oreal) is Owned by XYZ but Operated by Team Internet, any specific registrant requirements, peculiarities of EPP, extra extensions for premiums, pricing models and promotions etc are all decided by XYZ, CentralNICs job is purely to adapt their existing software/setup to allow for and store/supply that data not decide on wether there should be any.
Similarly whilst Nominet are providing the service/software (and to some extent the management of the audit of accreditations) for .gov.uk they have no say in the policies/requirements as decided by CDDO. Same with the numerous gTLDS that have moved to Nominet as Emergency Back-End.
In general all the RSPs want it to be as simple, standards and straight-forward as possible for obvious reasons, and thankfully none appear to want to adopt some of the more esoteric tld owner rules to apply cross-tld or overall.
Going the other way, GD being the only one I can recall layering on their own rules above-and-beyond the actual TLD Owners expectations with ccTLDs they've become Operator for.
Whilst the cyber requirements of being accredited for .gov.uk are "extra" to the usual Nominet requirements, I can see that becoming one of the standard requirements under the new RRAs being discussed as Nominet move to a less-members/registrars more ICANN aligned methodology.