General Data Protection Regulation don't exist in vacuum, other laws are regulating data handling. Most importantly, accounting related regulations. So, if you request your account deletion, all billing related information is still hold - that is probably 7 years in all EU countries. Sending unwanted mail for those addresses is different issue though, but having contact data as part of billing data is legal.

I have no dog in the fight (I'm not connected or loyal to Crowdflare whatsoever), but this is a non sequitur.

Companies work to priorities lists based on how important things are for customers. So it's perfectly plausible that the very reason they're not flawless at removing cancelled users from all their email databases is that they're too busy focusing on, as you put it, "the many far more privacy-relevant things they offer as a company", which they regard as far more important.

I'm not saying that's definitely the case here; I have no idea of any specifics. But I've definitely seen things happen that way in other companies/teams I've observed.

Yes, if they cant unsubscribe people. I could not care less, it bothers me more this guy crying about getting an email.