They aren’t invading the privacy here. They are preventing a malicious actor from running an attack via VPN and ssh tunneling in addition to IP address, device, etc. At worst they are associating IP with browsing at competing stores. Preventing the VPN was likely required by a lawyer and auditor and a risky attack vector for a billion dollar company.
Then why do their ToS say they use this data for advertising purposes? If they really need to be able to track you to prevent malicious actors, they can do so without using the data for advertising.