Whats the difference?

I think they meant shoot in like a friendly way. You know, happiness bullets!

It's likely a difference of emotion compared to logic. Emotionally they'd think "Damn it, now we need to check for such a weird specific edge-case, this is so annoying" while logically knowing it's better the tester caught it.

there's three qualifications to being a testor:

Finding stupid ways to break shit, Being able to accurately explain how you broke shit, and being likeable enough that breaking their shit doesn't make the devs angry.

But it could also be for legal reasons, like websites where you can post stuff for everybody to see, in case you post something highly illegal and the authorities need to find you. Another example is where a webshop is required to keep a copy of your data for their bookkeeping.

None of these require your account to "exist". There could simply be an acknowledgement stating those reasons with "after X days the data will be deleted, and xyz will be archived for legal reasons".

Mostly it's 30-90 days where they keep your data, just in case somebody else decided to delete your account or you were drunk or something

This is the only valid reason. But even then this could be stated so that the user is fully aware. Then an email one week and another one day before deletion as a reminder, and a final confirmation after the fact. I've used services before that do this. It's done well and appreciated.

This pseudo-deletion shadow account stuff is annoying.

It's quite simple actually: The user wanted to delete their account, but forgot their password so they requested a password reset. Before the password reset email was delivered, the user remembered their password and deleted their account. The password reset email is finally delivered and apparently some email clients open all the links in the background for whatever reason, so it wasn't actually the user who clicked the password reset link.

(DSGVO is the German version of GDPR)