How do I find out what my old developer actually controls?
Three public lookups tell you most of it. The ICANN lookup names your registrar. A nameserver lookup names your DNS provider. Looking up the IP address behind your domain usually names your host. None of them require a password. Then check your card statements for the recurring charges.
Can they hold my domain hostage?
They can make it difficult, but registrars have a dispute process and it turns on who is listed as the registrant and who can document paying for it. Keep the invoices and the email threads. Meanwhile, make sure the domain does not expire while the argument is going on.
Is it cheaper to rebuild than to recover?
Often, yes, if you still control the domain. A rebuild has a fixed price and a launch date. Chasing an unresponsive person has neither. The calculation changes completely if the domain itself is at risk, because a domain is the one thing you cannot replace without losing your search history and every existing link.
What if my email is in their account too?
Treat that as the emergency. Missing inbound email costs a business more than a dark website does. Getting mail onto a provider in your own name is usually the first migration to do, ahead of the website.
Can you take over a site you did not build?
Yes, that is most of this work. I start by writing down who holds the domain, DNS, hosting, email and the accounts around them, and telling you which of those you actually control today. That inventory is useful to you whether or not you hire me for the rest.
How do I stop this happening again?
Own the domain in an account in your business name, with your billing on it. Own the hosting account the same way, and give your developer a user on it rather than the account itself. Everything else can be granted and revoked. Those two cannot.