This is second on the list of "common domainer problems with trademarks". Number one would be an undue focus on whether a mark is registered.
Trademarks come in varying degrees of strength, scope, and fame. Once you get past the initial issue of "what is a trademark", then the next thing you have to wrap your head around is "what sort of trademark are we dealing with".
"Coca-Cola" is an extremely well-known mark for a soft drink. That fame confers a scope broader than simply whether or not it is used on a soft drink. If you attempted to sell "Coca-Cola" brand clothing, the fame of the mark is such that consumers might reasonably believe the brand has branched out in to clothing.
Trademark "infringement" is when a mark is used on similar or competing goods, causing consumer confusion. There are things beyond infringement. One of those is "dilution". Trademark dilution occurs when a famous mark is subject to unauthorized use which erodes the distinctiveness of the mark.
"Fame" is a term of art, but without getting too deep into the weeds here, the bottom line is whether - even if used on different goods or services - people might still associate that use with the mark owner.
Another factor to consider is the degree of distinctiveness. Aside from some particular categories like surnames and a few others, the basic scale of inherent distinctiveness looks at the relationship between the mark and the goods or services:
1. Is the mark descriptive, but nonetheless has acquired distinctiveness through longstanding substantially exclusive use? This would include things like "AMERICAN AIRLINES" which is an American airline or "BANK OF AMERICA" which is a bank of America, but both of which have acquired distinctiveness and are associated with a particular airline and a particular bank. Actually, "Coca-cola", a beverage originally made with extracts of coca and cola, started out as a descriptive mark.
2. Is the mark suggestive, such that some mental step is required to connect the mark to the goods and services? For example a "trek" is a journey. "TREK" is a brand of bicycle. The word is not descriptive of a bicycle, but suggestive of what one might use it for.
3. Is the mark abitrary, such that it is otherwise a dictionary word, but completely unrelated to the goods or services? For example "APPLE" as applied to computers, or "MONSTER" as applied to soft drinks, "TIDE" as applied to detergent.
4. Is the mark fanciful - a made up word with no other meaning than as a reference to the mark. For example "VIAGRA" has no meaning other than as a trademark for the drug sildenafil. "JELLO" for gelatin. EXXON for motor fuel.
That's the traditional scale of "strength" which will limit both the scope of goods or services which may or may not infringe or dilute, and also which will limit the range of what might be confusingly similar.
In domain disputes, however, the descriptive marks are somewhat "stronger" than in normal trademark disputes, since the logical use of the term in the descriptive sense is what is protected. On the other hand, the range of variations which are confusingly similar, is smaller, since a descriptive mark is sometimes limited to that particular presentation.
So, the answer to the question above - "Isn't the TM owner limited to the categories stated in the trademark?" - is "It depends on the fame and strength of the mark." What kind of trademark are we talking about?
If it's a fanciful mark, like "VIAGRA", I don't care what you are doing with the domain name or who you are trying to sell it to. There's only one reason to register that as a domain name.
...and that's exactly where this kind of thing matters. If we are talking about a fanciful mark - i.e. something with no other meaning than a reference to the mark - then there's no reason to be selling that domain name other than to profit from the sole meaning of that mark. If we are talking about an arbitrary mark - i.e. something that, apart from the mark use, is otherwise a dictionary word - then the circumstances are very different.
So, sure, selling a domain name corresponding to dictionary word, which might incidentally be a trademark for something, is perfectly legitimate. Selling a domain name which is a made-up word (or variation thereof) with no meaning other than as a trademark, is obvious cybersquatting.
The effort required to prove that is going to depend on the fame and strength of the mark. If you are selling, say, Tomato.com, then the initial assumption would probably be that you are selling it because it is the name of a common vegetable (yeah, I know, its a fruit, but let's not get off track). Is "TOMATO" a trademark for something somewhere? Probably. I didn't look, but I'd bet it is.
But the complainant with a mark for "TOMATO" for, say, lipstick, is going to have to prove a little more than "That guy was selling tomato.com" to prove that you were seeking to profit from his obscure trademark. They'll have to show that you did something that was premised on it being a mark for lipstick.
On the other hand, if you are looking to sell ExxonMobil.com, nobody is going to have prove anything about your motivation. Why you think that might be a valuable name is obvious. Duh. It's a huge oil company, and it doesn't mean anything else. There's no conceivable good faith reason to register that domain name and put it up for sale.
So, sure, if we are talking about ExxonMobil.com, then bad faith is pretty much automatic. If we are talking about Tomato.com, then we're going to need a lot more to prove bad faith relative to a trademark for lipstick, or whatever.