I had a conversion with an LLM about this. The payment was an Apple Pay not IAP or card transaction. The model confirmed that Apple will never submit information not present in the Apple Pay sheet. I confirmed the purchase did not request phone field. The model suggest that the merchant got the data from "Third party identity verification and fraud detection". So, Apple Pay was not the issue.