Taking over a domain is not particularly connected to access to PII.

You own/control the name, not the set of files on a hosting service somewhere.

If you buy someone's domain name, then they'll probably have emails going to it. So you set up a catchall address and discover what accounts are related to it, then you can use the reset password functionality to get access to the accounts. In some cases, they'll have a backup gmail account - and perhaps you can guess what it is (e.g. emails come through to Paul Davis so you guess, oh, maybe they have the paul.davis google account, and reset password on that).

But if someone else gets the name, they get your email going forward, and therefore access to a lot of your accounts.