According to other tweets: the export does not include Direct Messages which is what some companies use (almost) exclusively, meaning they cannot export 99% of their content.
Edit: ah the linked tweet (sorry, on a mainstream social media break), well that is certainly one company. I feel for them.
1. Departments/divisions have their own budgets; Quill was purchased before security or compliance was involved.
2. Quill was deployed or piloted for a group without retention requirements then escaped into the wild. Security or compliance wasn't involved until it was in use company wide.
3. A client required using Quill so the usual compliance requirements were waived.