for this to be a true "dip" you should be trying to sell those to see how much you'll make off them
I wish it weren't true - many times I've wanted a perfect domain to find it taken up by some loathesome spam page.
Furthermore, stuff that's common practice amongst squatters is expressly forbidden in other areas. At least in the US, you'd have a very difficult time trademarking an software company spelled "Microsoff", but typo-squatting is _rampant_.
There's a massively disproportionate amount of risk/reward for property speculation than there is for domain 'speculation'. If I find out about some new product coming to market and squat the domain - the company could potentially lose a huge amount of revenue, whereas I'm risking the cost of a latte.
In the end, any resource that is limited, underpriced and has some ability to produce income will get nailed by speculators sooner or later, and the price will rise.
Typo-squatting is of course unethical. I would not say that the practice is rampant. A recent report by Verisign showed that it is declining and really is not prevalent. It's also not very profitable. PPC revenue has hit rock bottom in recent years. Talk about risk.
There is risk it seems because there is a high learning curve for what a quality domain name is. If you watch the industry, research keywords and learn to evaluate domain names you can do very well.
As far as punishment, looking ACPA, 100k penalty for cybersquatting. That's taken out some of the biggest offenders (see IREIT).
auDA ruled a few years back that "domain monetisation" falls within "a service that the registrant provides" (with a few exceptions).
Sales/transfers of domains were a bit painful back in the day but have been relaxed now. There are restrictions (from memory, you can't register a domain and then sell it within six months) but it does make speculation a bit easier for domainers.
Marketplaces: sedo, afternic
and plain ol' contacting people who might be interested via email, phone, letters, walking up to their store.