They provide this to Verisign, the Root Zone Maintainer, who create the
root zone and distribute it to the root server operators.

Technically, IANA provides database change requests to Verisign. The actual database is maintained by the Root Zone Maintainer (hence the name).

Verisign does
this under a contract with NTIA, one of the few bits of the Internet that
is still under a US government contract:

https://www.ntia.gov/page/verisign-cooperative-agreement

Err, no. You forgot the little bit about the IANA Functions transition. Specifically:

Should ICANN attempt to mess with the distribution of the root zone, let
us just say that the results would not be pretty. There's a balance of
terror here. ICANN carefully never does anything that would make the root
server operators say no, and the root server operators carefully avoid
putting ICANN in a position where they might have to do that.

When you say “ICANN” who, exactly, do you mean? ICANN the organization or ICANN the community? If the former, ICANN Org can’t do anything outside of ICANN community defined policy or process or risk all sorts of unpleasantness from internal policies to lawsuits to the ICANN Board being spilled. If you mean the latter, ICANN org must abide by the ICANN community’s demands or you get to the same point as previously mentioned. That’s the whole point behind the “Empowered Community."

I'm not guessing here, I go to ICANN meetings and talk to these people.