Tracking is more difficult for P.O. boxes. This is why a lot of businesses don't deliver to them. The company providing the P.O. box can sign for it and the buyer can claim they never got it. There's a separation between the destination and buyer.

With a residential address, you send it to yourself or someone you trust, and that's the person who signs for it.

This is where a compromise has to be made with P.O. boxes. I'll allow them (most businesses just don't) but because the same extra degree of separation that gives you extra OPSEC also opens a wider door for scammers, the policy has to reflect that risk.