But we've seen how useless even apparently well meaning anonymisation is—think of the AOL search results. I can't imagine how utterly useless it becomes when it is done by people in whose interest it is to do it poorly, while remaining just within the law.
The protection of the law does add to the security. Also anonymization of the PII (scrubbing into just a serial number) combined with the dilution of purchases into larger categories provides lots of protection. Your google search history is lot more detailed and granular than most of the purchase data you can buy through data markets. You might be able to figure out a basic "profile" and maybe use lookalike modeling but it would be incredibly difficult to actually distill that to a discrete person.
There's also been a push to buy "insights" rather than just data to get more ROI with less effort/cost so instead of buying purchase histories you would just buy a segment of people interested in buying washing machines for example.
PII is not available, it is anonymized. There are laws around this. Purchase data itself is usually grouped into major purchase types, not amounts or actual goods purchased.
For that detail, it would be the CRM/ERP systems of the manufacturer that has that information tied to a serial number and this is why they ask you to register your product when you buy it. Some manufacturers might work with data providers to exchange this data (serial numbers in exchange for purchase histories) but it's rarely done at scale because of cost, complexity, legal/security risk and lack of options to benefit from it.