Note how that statement is worded. "Apple doesn't retain" means they very well have access to the transaction info, they're just not storing it. I wouldn't call that designed in such a way that they can't read your transactions. It's more of a promise, similar to how google analytics promises to remove the last octet from IPs if you enable a flag.