This is just semantics on your part. Whether it's a company being sold, a division, or only a product, then reasonable companies will consider the data handling in a similar way with multiple gap analyses to mitigate concerns. Context is going to dictate what happens. Lesser companies will not consider this heavily and you can end up with the data being more of the value for the transaction. Whether we like it, or not, we are left to trust that these companies will make efforts to enact good policies and follow them.
What I'd expect to happen here is that Google and Squarespace will familiarize themselves with the posture on both sides and Google will want the standards to at least be maintained to a level which removes liability to them. They are very aware of the scrutiny and a big player here so they can force the acquirer to step up to a certain degree.
I don't know enough about Squarespace's security, or complete business model, but they'll be trying to work out what gaps they may need to fill. Google may have clauses that require that this data can't be co-mingled, or must be handled in specific ways for certain countries. The actual handling and what is communicated can take some time as the teams work out how they deal with any gaps. It's also possible that Google find some gaps on their side and have to resolve them before any transfer could actually happen.
Given the implications of service continuity if domains aren't transferred or operational, I can't imagine that they would ask customers to take some action. It creates a support nightmare with confused customers talking to support and then being unhappy they still took the wrong action when you ask them to approve the transfer.