The goods are usually exchanged via post and cryptocurrency. The seller generally drops off the goods in random post boxes using prepaid [express] envelopes and usually disguising the packages in some form such as by masquerading as an ebay seller or with a real/fake company as the source address. This is very difficult to track, especially if the seller does a good job distributing the drop offs over a wide area and by using a large set of random source addresses.
Of course, if the packages are detected in the postal system the recipient can be unmasked, but small time buyers are of little interest to authorities. There's nothing that the authorities can do to unmask the sellers even with all the information a buyer is able to provide them.
