For .ca specifically: as long as you are a Canadian individual, or have a sufficient connection to Canada, or a Corp with a trademark registered in Canada then you are qualified to own that domain - but as to who is really checking I have no idea… CIRA complainants maybe?

Here’s some info about .world domains https://support.google.com/domains/answer/6300841?hl=en#zippy=%2Cterms-restrictions

Good dam times ? (Idk)

If it’s public information why would it be illegal? If I understand correctly the only thing stopping anyone else from doing it as effectively is Meta’s ability to aggregate the data and find the buyers, and perhaps morals.