Like @arieljannai says the answer depends on the TLD, so here I propose another way to look at it, that you could apply to other cases. So same "TL;DR" but different explanations.
If you look at the IANA database of TLDs, which is the only authoritative one, you come there for .ID: https://www.iana.org/domains/root/db/id.html
You will then find who is the registry for this TLD. Only the registry of the TLD is authoritative on rules governing everything concerning this TLD.
In that case it is: https://pandi.id
Now, depending on the case, you may find registry websites more or less organized, up to date, with relevant content and hopefully with English translation.
So in this case, it does not seem to bad and if you browse it a little you should arrive at:
That should be the registry policy but at least in English that is not very useful as a page. Maybe a translation missing?
But in fact almost all pages in English are empty of content. Not a good sign...
If I go to the Indonesian version of "Registration Requirements" and do some online translation I get this as constraints for .ID (note that there are other subdomains of .ID available with probably other rules and more constraints):
• It is intended for individuals, individuals, citizens of Indonesia, foreign citizens, or legal entities.
• If the Applicant is a State Implementing Agency, then the registration of the Domain Name shall follow the Minister's Decree on Communication and Informatics.
So from this quick look I would say it can be reserved by anyone. But the devils may be in the details. I advise to go to some trusted registrar and see if they have information on that TLD to make sure you can buy it. I can not and will not give you specific names of registrar as that would be obviously personal biaised opinion. You should start with the companies you already use if you already buy domain names.
Now if you decided to buy such a domain name, you need to find a registrar. Again the registry website should probably have a page on that, here it happens to be: https://pandi.id/en/registrar/list-of-registrars/
If you find other companies selling it, they are probably resellers of some of these registrars. It is not bad per se, and can make even more sense in some cases, depending on your constraints, but it also means that there is one more provider in the path between you and your domain.
All registrars seem Indonesian ones (or the registry web page is awfully out of date for both languages), the registry may put some constraints on that.
This seems indeed to be what point 4 of the FAQ says, again translated:
PANDI has selected Indonesian companies interested in performing registrar functions. There are twelve companies that qualify to be PANDI registrars. You can register a domain name on the twelve companies.
Sidenote: note all TLDs today work in the same registry/registrar split as known in gTLD. In some TLDs, you may not have registrars at all, and in others you may have registrars but the registry may also sell domain names directly to end clients.
Also remember one specific things that is often forgotten, as obvious as it may be: when you register a ccTLD you are automatically being put under this country rules, for example on things like DNS censorship, sensitive words on so on. You are bound by those rules that can change and can impact you. It happened in the past for example in .LY
And when you are buying a gTLD you are probably at least in part bound by US laws for multiple reasons.
This is especially important if you decide to use some specific TLD to do some "domain games" by doing some "clever" naming.
One another point: when you will get problems or questions on your domain name, you will go through your registrar, but sometimes you may deal with the registry directly, especially for disputes. You have to realize then, again as obvious as it may be, that you may be required to speak the country language to get yourself understood by the registry and understand them, and you will of course be also bound by their hours of operation (like for urgent matters they may be closed on their timezone when you need them).