The worst part in my eyes is that at least with some registrars (I experienced this with Dotster), you have to disable whois privacy in order to transfer the do

The worst part in my eyes is that at least with some registrars (I experienced this with Dotster), you have to disable whois privacy in order to transfer the domain away. They don't let you receive the authorization code at the anonymized email address, so literally the only way to transfer the domain to a new registrar is to turn off privacy, exposing your information to the world. There may be a technical reason behind this, but it feels more like a way to hold you hostage and prevent you from transferring.