The surface level distinction is that a boycott is aimed at an organization while canceling is aimed at a person. That has deeper consequences because our mental model of organizations and people is different.

With a boycott, the intent is to change the organization's behavior. Once the organization stops doing the thing you don't like, you can stop the boycott. Problem solved.

But with canceling, there is an assumption that people have a deeper, immutable character. They are canceled because of an act or acts they have already done, and the cancelation is intended to be permanent based on the assumption that those acts reveal who the person really is and that we can never trust that they won't do those acts again in the future.

Part of the justification for this is that canceling a person sends a signal to other people "don't be like that". The canceled person is considered irredeemable but an accepted casualty to root out a societal ill.

It's also important to consider what people are being canceled from. This is a sanction mostly applied to celebrities and politicians. These people are not being ostracized from all society—they can still go to the grocery store. They are being kicked out of the high prestige realm they were a member of.

In that sense, it's maybe more acceptable that the sanction is permanent because they're only being kicked out of a club, and not left to die alone in the wilderness.