First of all, the system operates on a complaint basis - they're not interested in being handed evidence of GDPR breaches, they're only "interested" (in quotes because the entire process feels like they're being forced to do something and do the bare minimum, as opposed to genuinely caring about protecting & defending citizens' privacy) in complaints where you didn't get your way. Imagine if the police wasn't interested in the location of a wanted, violent criminal and turned people away with "come back when you've actually been shot by him".
The complaints process puts the burden of investigating, documenting the breach and verifying further compliance onto you. It is extremely admin-heavy and requires you to first argue with the company and give them 30 days (more in certain specific scenarios) to respond, so a malicious actor can drag out the process for months before you can even proceed with a complaint to the regulator, and once the regulator takes action it is up to you to assess whether they now comply, and if not, go through the whole process again.
Finally, if you've made it through thus far and actually have a valid complaint that doesn't give these lazy idiots a technicality to use as an excuse to close your complaint, it'll rot in a queue for months, and when it actually gets processed and actioned, the only outcomes I've had so far (including for a company clearly acting in bad faith and probably breaking more laws than just the GDPR) is the ICO sending a letter which the company can ignore in total impunity, with the real-world penalty for ignoring it being another letter.
Imposing such a "penalty" obviously requires going through this whole process again so in the real-world very few people will make it this far to begin with, let alone following up on further non-compliance.
I'm also doubtful of their technical proficiency so I'm afraid they can trivially be defeated by the company using some technobabble to justify why they can't delete accounts if there's no expert on hand to debunk the BS excuses.
It is a war of attrition in which the regulator (at least in the UK) is in cahoots with the enemy.