They keep the domain for a certain period where no-one else can purchase it ("Auto-renew Grace Period" + "Redemption Grace Period"), but the past owner [ie you] can still recover the domain by paying a fee for renewal and you can still transfer it (see quote below). Then the domain is released for any registrar to purchase from the registry.
See this ICANN infographic:
Now, registrars can reserve a domain without paying (or they could in the past), for a short period, then return them to the pool, so they can grab it and be the only registrar you can use, temporarily. Once domains enter the pool proper you can't guarantee to win it: the first buy order (which might be a squatter, competitor, someone with a back-order, ...) that ICANN process will take the domain; I'll say again you can't guarantee to win it.
Back-order sites exist, they attempt to be the first buy order that ICANN receive at the close of the delete period when the domain is released. I don't know, but I assume this is buy being close to ICANN's server (in network terms) and banging them with requests.
If you currently control the domain, and the domain is valuable to you, the easiest thing to do is renew it; then initiate a transfer in good time before your new renewal period ends. However, you can officially renew:
You have the right to transfer an expired domain. Registrars are not allowed to deny a transfer due to expiration or non-renewal. (unless you haven't paid for a previous registration period). (ICANN, point 4.)
Just don't expect the registrar you're leaving to be happy about doing it for you!
See also "Expired domain deletion policy".