They did NOT show that, from 3-4 transactions, they could provide your name, address and phone number, or even that if you have 3-4 transactions in a million transaction anonymized data set they can find out anything about you personally *unless they know you first*.
What they did is show that if they know that you, personally, had 3 to 4 types of transactions on specific dates (you went to a grocery store and a gas station today, and a restaurant yesterday), they could identify which anonymized data set you belong to. Their discovery requires specific outside knowledge not contained in the data.
This only matters if, say, a third party could identify specific purchases and dates - they could then comb the records and find the rest of your transactions on that specific card. IOW, someone has to be looking for you, and know at least something about you, to even start the search.