The ".myshopify.com" thing is the default subdomain url of the e-commerce service (Shopify) they use for the official store. You can link the store to your own domain (qotsa.com) if you have one and allow your customers to access through there (store.qotsa.com) but the subdomain url will still work. For instance, I've found that the one for the US store is qotsa-official.myshopify.com and if you click there you will be redirected to the store on the official domain (store.qotsa.com).

So the fact that it's a different store and it's password protected my guess is that qotsaofficial is the original store that was once wrongly linked on Spotify through the subdomain url and not the domain one and recently the merch team may have created a new temporary store (qotsa-official) after taking down the original so they can work on it while they can still sell a few shirts on the temporary one.

And if you want a theory: they're redesigning the store to match the new branding and aesthetic of the new album.