In the example you are referring to, the WannaCry attackers used Shapeshift to convert Bitcoin for Monero.
Shapeshift would have access to the sending Bitcoin address (known publicly as the WannaCry address), the IP address that accessed the website, the known given outputs to the Monero address, and the receiving Monero address. Minus a few other points of metadata, that's about it.
For Zcash, the leaked data would have been essentially identical if sent to a z-address. However, since Shapeshift does not support sending to z-addresses, Shapeshift would have also had access to when the attacker moved funds from the t-address (and to where - either another t-address or some z-address).
There is no way for Shapeshift to know for certain when the funds are spent on Monero. They know which transactions use the same outputs, but these outputs are likely used in several transactions. Furthermore, the attacker could send Monero to themself to increase the output anonymity set. Investigators are likely looking at how the outputs have been transferred on the blockchain by these different participants over time. They hope to narrow down the anonymity set based on user behavior.
You mentioned the view key, but Shapeshift presumably does not have the view key of the attacker's Monero wallet.