I'm investigating the same questions.
As far as I remember there used to be a guideline in Design 4.4 Extensions which prohibited In-App-Purchases inside app extensions but I can't find it anymore, so apparently they've removed it. I think I have come across an app which sells IAPs inside its AUv3 extension so it seems to be fine. But please don't take my word for it.
I have implemented IAPs directly inside my framework, which is nested inside the extension and it works on my device. I am not sharing data with UserDefaults or anything like that. When I verify the receipt I make sure that I access the bundle and version identifier of the main app, because otherwise it will use the bundle identifier of the extension or framework which will not work.
I haven't had the chance to test it with a real release from the App Store yet and I came across this thread which is quite old but it made me realize that there could be a problem: Eventually the extension will not have access to the receipt in the Main Bundle when published on the App Store.
Please let me know in case you've figured out a way.