Or did they simply sell something like "of our 100000 users, 30% bought Lyft rides."?
I mean, I still think it's wrong, but selling who bought what is a bit different than selling how much of a group bought how much of an item.
Their privacy policy lets them sell individual messages as long as they're scrubbed of "personal information." Where their bar is for that is anyone's guess.
If all they wanted to do was collect and sell aggregate data, you'd think they would say so, and would have reiterated it in their "apology." If they actually gave a shit about their users' personal data, they'd make sure their privacy policy was as restrictive (for the company) as possible while still permitting them to operate.
"We collect such commercial transactional messages so that we can better understand the behavior of the senders of such messages, and better understand our customer behavior and improve our products, services, and advertising. We may disclose, distribute, transfer, and sell such messages...." [emphasis mine]
Of course they might not sell your messages, but it's pretty weird that they'd put up a "we totally can sell your vaguely anonymized messages" and then not take advantage of it. What they sell to Uber may not be what they make available to you.
Even if they don't currently, they could start doing so at any time. And even if you somehow trusted them not to, they could get bought out by someone not so trustworthy.
Now I'm curious: what is the commercial value in the aggregated email content that would make someone want to pay for it, besides the purchase and receipt data that Slice is already providing (plus subscription and open rates)?
Until all companies that trade in user data are required to disclose how they do so by a regulatory body, and users have an access to an example "slice" of the data being traded, this will continue the way it does, because the incentives are there.