It's also reasonable logic to hold any property hostage that has an outstanding dept associated with it. That's just a lein and is a common legal process. This is different from simply "account is no longer active"
So, it's not so cut and dried and obvious. Like a lot of things, if it's obvious and simple it's probably also incorrect or at least incomplete.
I'd say they should be either deleting the data OR allow export of the data as of the last time the account was current if they retained it, not retaining it and then holding it hostage. That is essentially using someone else's property for your own purposes.
In this state it's a form of threat that I'm not sure would pass a good thorough legal exam8nation.
Consider, they are holding something of yours which places you at risk where they might get hacked and leak your passwords, or they might even sell them to someone else who you never approved of, all while you are no longer consenting to their posession of this material. The entire company, meaning all assets, meaning your data, being sold to someone else absolutely qualifies, and has even already happened. That threat is at least a little bit like a gangsters protection payment then a legit lein.
I think this means that really the law of the land should be that they are obligated to delete anything that isn't current (covered by an active account or contract), with only some well defined and not-forever grace period to cover mishaps.
Think of the bright side; it's a good thing this bit your company at this early stage and not with half a million dollar contracts.
The refusal to provide access without renewal is scummy, but this complaint is silly.