It need not; for example it doesn't need historical data that have been superseded; if it no longer has an app available for download it could purge the fact that you bought it; it could give purchasers an anonymized download key that their phone could store (or cache in icloud someplace).
Yes, I know plenty of online companies do routinely spy on users but I see no reason to consider this "of course". This is admittedly creeping into meatspace (there's absolutely no legitimate reason for causing things like automatic toll tags or driving licenses to supply privacy-busting data to third parties, but on the other hand plenty of sandwich shops manage to have "frequent diner" programs that are simply a card the customer carries which is punched each time a sandwich is purchased. There is no reason why an online business shouldn't do the same -- and GDPR should drive businesses to do so. It's in the customer's interest.
For budgeting purposes I’ve tried to find a full list of my iTunes purchase, and couldn’t find it in the store. Didn’t think to look in privacy.