Completely safe to cancel

The mistake

A recurring domain-registrar charge appears on the billing statement as a generic, unlabelled line item rather than being tagged against the DNS/hosting infrastructure it pays for, so a cost review can't associate it with anything currently visible or in use. Nobody cross-checks the subscription against the company's actual domain records before cancelling it, so the registration lapses and the domain becomes available for anyone to register. Because the same domain also serves the company's outbound email (MX records), losing it takes down the live site and blocks legitimate email to that address, including the confirmation needed to buy the name back.