Ok, that's is strange! Thank you for this! On the list you can check the little (!) icon and find out, how google got the information. In my case two order items was extracted directly from gmail.
Mining your email for keywords and selling you things has been part of their business for a long time. Knowing what you've actually bought is just part of that.
When I book a flight, Google notifies me when the flight is leaving, providing suggestions about when to leave my house in order to make it.
All of these things can be done from reading your email. For someone invested in the Google ecosystem, this is a nice and seamless integration that helps me in my life. That is why they are extracing data from your mail.
If you are a merchant, there are standards for sending package/order information in a machine-readable way in email:
https://developers.google.com/gmail/markup/overview
The purpose is to provide personalized useful features like package tracking. When logged in, you can search for something like "my packages" or "where are my packages". This is a feature that users expect from other assistants (e.g. Amazon Alexa) and email clients (e.g. Outlook).
https://support.google.com/websearch/answer/1710607
The categories that are being extracted for personalized search should be fairly limited (primarily hotels, flights, online purchases).
If you don't feel safe or secure using Google products, you should strongly consider switching away. I personally would suggest Outlook.com, but you could also self-host or use an indie hosting provider like FastMail.
(Most product folks make trade-offs for the average person. There are some great security tech coming out of Google (Security Keys, Chromebooks/Chrome OS) but a lot of the security assumes at least moderate trust in Google.)