A developer can issue a refund request on behalf of a user - its just that they can't do the refund themselves because the developer doesn't hold tokens for processing the payment. Doing so gets into issues of PCI and user privacy.

https://developer.apple.com/documentation/storekit/transacti...