Why would they be sanctioned? If GoDaddy is the registrar for a domain, GoDaddy knows who the real owner is. They have to, per ICANN rules.
And if GoDaddy reaches out to that customer on behalf of another customer, they don't reveal any private information. Each customer only sees their own interaction with GoDaddy. They don't see each others' info.
The ICANN states that you must provide a way to directly contact a domain's owner. If I'm correct, the contact info must be freely available in the whole, whether it's an email address, an obfuscated email address, or a contact form on the website of the registrar.
Charging for this is really shady, but not contacting the domain owner when requested is a registrar agreement violation.
Note that it's also the responsibility of the registrar to ensure that contact information of their registrants are correct.
If it was a ccTLD (2 characters on the TLD), they could also be sanctioned, depending on the rules of the extension.
The sanction can range from a (huge) fee, to a revocation of their accreditation, so it's not nothing.