Yeah we got away with this for 3 years too and in our most recent updates have been forced to add IAP. As another poster mentioned they've been cracking down tighter and tighter even on small apps.
Our product has a real-world component yes but the payment part had more to do with the online subscription (which gave you access to the real world component).
Covid killed our product though so for us I'm relieved I don't have to deal with Apple's shit anymore to get the app deployed.
Still have to deal with it for other clients though :/