So, to me, that "by default" is all you need to know. Plus, perhaps, enough awareness of how society works to realize that literally any default configuration can be overruled by a court order.

In other jurisdictions, such as the USA, it doesn't even require that.

And, while I am not the kind of person who saves these things for later, so perhaps it was different 4 years ago, but the current version has the bog-standard - and therefore completely forgettable - disclaimer about complying with legal obligations that you see in every such policy. And since it is such a bog-standard thing, I would assume it was always there, though, of course, it's not the kind of thing I would have noticed and remarked upon, let alone remembered, when I originally read it.

Which has me wondering, what exactly is the ask here? That they include a full copy of the privacy policy on every single marketing page, so that nobody can get up in arms about how they didn't mention every single detail on whatever subset of pages they happened to read while signing up whenever something they didn't anticipate happens?