Correct, we don't want to free the allocation directly in the init function. Look at epan/tap.h for the documentation on register_tap_listener. The 2nd argument is "tapdata", or, the instance of the tap and all its state.
If you look at tap-rpcprogs.c, in rpcprogs_init(), you'll see a much clearer example.
The reason tap-iousers.c looks strange is that "&iu->hash" is passed as "tapdata".
*However*, the last argument to register_tap_listener() should be a "tap_finish" function which would free the memory, and that is missing!
I see some other taps in ui/cli that also forget to add a tap_finish callback. For example, tap-smbsids.c is also missing a tap_finish callback.
I guess no one noticed because these taps are instantiated a handful of times, at the most, during the running of tshark. So, it's a very minor oversight.
Gilbert