You have brought up what is precisely my concern, and what I couldn't convey to support.

If I open a ticket with the domain name, what's to stop the access being removed, and declaring "problem solved", without actually addressing the underlying issue?

Either delegated access remaining after a sale is a mistake (in which case there is now "unauthorized access"), or it's "by design" (in which case users should be made aware so they can remove this access after buying a domain). Regardless, I think you shouldn't need to know the specific domain in order to say which situation it is.