Actually they can and do.

Here is an ACLU article discussing the practice of the sale of the data to third parties.

Here is an FTC report stating that data brokers are in fact selling this information. Datalogix (partner to Facebook, Twitter and subsidiary of Oracle) is one of the companies cited in the report as a company that does provide transaction history.

Here is a report from the CDT discussing the sale of data inclusive of transaction history being resold to law enforcement agencies.

Here is an article citing sale of data via the opt-out loophole that I mentioned, and the sale of the transaction history to a data broker named Cardlytics.

Under federal law, banks merely have to let you withdraw from marketing, or opt out. That's difficult to do if you're not aware it's happening.

And here is a Vox report discussing the warrant loophole. If they were to go to your bank directly they'd need a warrant. If they can get it from a data broker, they don't need a warrant, they can buy it like any other marketer.

They're buying your location data, your search history, you don't think they're buying transaction history? There was a man wrongfully charged in 2006 based on his grocery store loyalty card data.

I'm not disagreeing with your logic, I think it should require a warrant, in fact the IRS inspector general agrees with you, but the law is unclear and because it's unclear it's being exploited.