Loyalty cards aren't required to sell coffee. Nor do they have to be tied to a person.
We shouldn't go along with the framing that loyalty programs and retaining all this information about customers is required to run a business.
$4,000 doesn't seem adequate if they could gain access to Starbucks card data. Given a card number, they could purchase using its entire balance, repeat ad infinitum.