How does rewriting $x^2 -y^2$ as $(x+y)(x-y)$ avoid catastrophic cancellation? Why is rewriting $x^2 -y^2$ as $(x+y)(x-y)$ a way to avoid catastrophic cancellation?

We are still doing $(x-y)$. Is it because the last operation in the second form is a multiplication?
$x^2-y^2$ will be only as precise as $x^2$ is. If $x$ and $y$ are close to each other, the computational error might be larger than the result.

In the second case, less loss of significance occurs.

Consider e.g. $x = 9000.2$ and $y = 9000.1$, where the floating-point precision is 5 significant digits. $x^2-y^2$ is actually equal to 1800.03.

Let's try to compute it in $x^2-y^2$ way: $x^2 = 81003600.04 = 81003000$; $y^2 = 81001800.01 = 81001000$, so $x^2-y^2 = 2000$, which is quite far away from the precise answer.

So let's try to compute it in $(x+y)(x-y)$ way: $x+y = 18000.3 = 18000$; $x-y = 0.1$, so $(x+y)(x-y) = 1800$, which is significantly closer to the precise answer (and is actually as close as possible with 5 significant digits).
The loss of significant digits is approximately the same for both computations. The second approach will sometimes give you an extra significant digit, but that's not what I would call a catastrophic cancellation.

The real advantage of the second approach is that it avoids unnecessary arithmetic overflow, if $x^2$ and/or $y^2$ exceed the largest representable number. (Or arithmetic underflow, if they are smaller than the smallest representable positive number.)