They're not. In-app purchases have to go through Apple. You're allowed to sell things outside of the App Store so long as you don't try to use that to circumvent purchases available within it. For example, you can watch videos in several streaming services that you purchased or entered digital codes for. You can't however make a new purchase within the app without hitting an Apple server. Apple logs those purchases and backs them up to your account and hosts the servers that the actual app sits on along with the content for those in-app purchases. That infrastructure allows customers to use one account to download it and nearly guarantee no malware while also giving a platform for people to give feedback on that app.