In theory, there could still be a possibility to track through the retailers who bought which one-time code (or have particular buyers be sent particular codes). But Mullvad also simply accepts cash by mail.