The issue here is not "were they authorized to do this?". They were. The issue here is that their actions indicate that they cannot be trusted. Do they require

The issue here is not "were they authorized to do this?". They were. The issue here is that their actions indicate that they cannot be trusted. Do they require the business owner check a box "Yes" or "No" and initial next to the clause where the business owner authorizes GrubHub to operate their brand without further consent? No, they don't. That they do not implies to business owners that they cannot trust GrubHub. That they refuse to notify business owners when they register a domain using their brand implies to business owners that they cannot trust GrubHub. That their response summarizes as "you signed a multi-page contract that permitted us to do this without notification to you when we do, stop whining about it" implies to business owners that they cannot trust GrubHub. This is why they are so desperate to shift the framing of the argument from "GrubHub broke trust" to "GrubHub was legally authorized to act this way". They aren't willing to change their behavior, and so instead they simply try to reframe the news with a press statement.