What is the ruling on someone who took money from a person to deliver it to another, but then bought something for himself with it? Is expiation required of him, knowing that it is now difficult to inform him of what happened and return the money to him?

What you did is a betrayal of trust, which is forbidden by Islamic law. Its expiation is seeking forgiveness, regretting the action, and resolving not to return to it, as well as returning the trust to its rightful owner. The fear of exposure does not justify not returning a right. If it is possible to deliver it through indirect means, there is no harm, as the aim is for the right to reach its rightful claimant. You have the choice between returning it to the one who sent you with it or to the one it was sent to.