Sure, it's a fair criticism that they are trying to push a subscription. Coin is a little archaic, I personally never even have cash with me, but they could have an NFC tap for a single purchase.
But their subscription approach also makes sense and would benefit some frequent visitors. I assume it means you can use the subscription on all of their machines. And there's simply no easy way of doing that other than using an app. Could be a web app with QR code, I suppose.
Apps can't "scrape your device for useful information". Modern apps are sandboxed and only have access to what you gave them permission to. Usually, they just gather the information from within the app. What you clicked, when you clicked, why you clicked, etc. If you give the app permission to location data and contacts, then they'll grab those, too, but you always have the option not to.
This is why companies, like Google, Amazon, Meta, try to push their own devices, they can have full access to your data.