Unfortunately, if the EU’s DMA is any indication, Apple can do a lot more than just tie this to IPs. They can combine IP + registered card information + GPS of device. Not sure how thorough they’ll choose to be, so I hope you’re right! But it’s not a safe bet to think a VPN will fix this just yet until we learn more.