Thought I'd add how I resolved the problem:
I didn't quite understand this (Namecheap were, IMO, deliberately evasive on the issue) but you still own a .io domain during the pendingDelete phase, even if it is in the registrar's control! You therefore have the right to transfer the domain from the registrar's control to your own control, which is free. In my case, Namecheap refused to give me the transfer AuthCode (a.k.a EPP), but I was able to "reset the owner's password" through nic.io (I'm not sure exactly what that meant, but it worked). The domain was now in my control but remember it was still expired, so I just had to pay NIC.io's (reasonable) renewal fee.
So, that's how you can regain control of your expired
.io domain, for free, without having to place a back-order. Regarding the DNS issue:
As Michael Hampton explained, NIC.io do not provide DNS hosting (i.e. will not point your domain to an IP address), but will point to authoritative DNS servers of your choice. That is, you'll need to get another company (typically a registrar) to provide DNS hosting, then have NIC.io point to their DNS servers. Cloudflare will do this for free if your setup is simple.
This is all a bit tangly and opaque but hopefully it's useful to someone. Basically, Namecheap's fee for reinstatement is a total rip-off and can be avoided if you do your research! Good luck!