It's actually pretty interesting because if you for example create a facebook site about security facebook.com/security it means they cannot make a data security site anymore.

My guess is they have a list of forbidden urls and in other cases when they need the vanity url they just take it.