Storing the operations for ever is not necessary - they could apply an upper bound on what latency is reasonable; the server then could coalesce changes into groups (sorted by position in the document, transformed into a position at the end of the group of changes) for history. For undo, they could use grouped changes after a certain number of operations of history.

They would then be able to implement sharing without allowing access to the history.

Alternatively, and more easily, they could record the state when someone is given access to the document, and not allow access to operations received by the server before then unless they are granted a separate permission.