depending on how old the accounts, many of the regulations and practices you are expecting to be practiced weren’t yet in existence. perhaps they follow them now. companies have to get into compliance, and in the meanwhile, companies as big and sensitive as equifax and experian go “oh sorry…”
but, no, if you think companies as a thing are consistently, completely, correctly removing data, you are mistaken.
it isn’t even always due to negligence, and in those cases it may be quite legal. it may even be required. if not required legally, it may be in what you agreed to.
but is it secure?
what typically does not happen is a user’s request cleanly triggering a sanitization of all data they have generated on the targeted platform and periphery.