You did probably opt in and just don't realize it. They are most likely using square or stripe and at some point you put in an email for an email receipt at a store. At which point you gave the payment processor permission to link your email to your credit card for all vendors that use them.

It's still shady and I would support a law that requires every store to individually obtain your permission but I suspect it will get pushback because getting email receipts is a common convenience for people.

That said, as a practical matter regardless of whether it's morally right for them to do it or not, I suggest making a junk email specifically for store purchases so all that garbage goes into one place.