How would a criminal take advantage of this fact?
Assuming that the criminal wants to recover data from your old machine they will likely remove the hard drive and connect it to another system which can read it directly.
If it was encrypted (I assume not?) they will probably realise this pretty quickly and they'll abandon the exercise and sell the machine on.
If not encrypted data recovery tools can be used and probably get just about everything that was on the drive, including stuff that you may have deleted a long time ago. The result is broadly equivalent to someone having access to your machine if you leave it logged in and unattended.
If they are after something specific and have some technical knowledge (i.e. they know how to do what the data recovery tools are automating) they could target specific 'patterns' on the disk, which will enable them to focus on what they are after and only recover what is 'important'...if they can find it. This has the potential to recover far more information because it is not constrained by the limitations of file recovery software and can find information in corrupted or partially overwritten files.
What is the probability of any of my sensitive files (passwords) being compromised
There are people around, including criminals, who will specifically go after secondhand machines to recover data from them, though not necessarily for nefarious reasons, for example many years go I used to buy old hard drives when learning evidence collection and data recovery techniques. It is unlikely that you have sold your old machine to someone like that, but it is possible.
If the disk was encrypted - low probability.
If the disk was not encrypted:
- Information stored in a text document, or similar, almost a certainty.
- Cached passwords may or may not be recoverable depending on the application.
I suspect, though I have no evidence to back this up, that credentials stored in keychain will not be vulnerable without a brute force attack or knowledge of your login password.