you pay the company that bought the rights for that TLD from ICANN, so ".com" is owned from Verisign, yes, one company controls all .com sites, then you have countries owning their own TLDs, that's ".co.uk", ".fr", ".pt", ".de", etc... Then those companies with a TLD rent you SLDs.

To have the rights to a TLD, you'd need about 100k just for the process of approval (which might get rejected), in the end, ICANN has the full control of everything as they control the root zone. Our only solution to bypass it is to create our own root zone and use that instead.