To bad that the serial number is not on the outside of the package.
And if it is, the cameras are not able to show them in an readable solution.
The only thing the cameras show is that you bought a printer.
But not which one of the 10/20 in the shop.
And normally the recordings get deleted after some time.
Your last point is the only one that has validity.
If they do have the recordings then they have something concrete to go on.
Even if no recordings then they could go into phone metadata records to find out who was in/near that store at that time and date.
Paid by cash? Search nearby ATM record data for that and previous days for cash withdrawls.
All they need is a list of names to start narrowing down potential suspects, they don't need proof.