In some countries, they need to keep it for 10 years for tax and audit reasons.

I wouldn't call 10 years "recent transactions". Heck, for most of the online shops, it's more like "forever".

Which countries?

I don't think "need" matters here. They have a record of a transaction, and they want to keep that record. I don't think I have a right to demand that they delete that data.

The GDPR/CCPA/etc. likely has different requirements here, and probably requires deletion after they're no longer needed (for tax purposes or whatever).

But I personally have financial records going back decades, so I can't fault a company for wanting to do the same thing.