Hit containers and visit containers act very differently.
With a visit container, if any hit in a visit matches your segment criteria, that whole visit is included in the segment.
Whereas with a hit container, only the exact hits that match your segment criteria are included.
So what's happening here is that you're getting hits outside of the purchase event that match your segment criteria. For example, a user comes in through email, then later in the visit, they come in through natural search. Since for at least a few hits the last touch channel was email, the whole visit was pulled in for your visit-level segment, but not your hit-level segment.