Don't ask for personal data then.
Unbeknownst to us (or the hr system owner) after a software update it started sending us extra fields which would occasionally include the office managers name and contact details (including home address at times).
Had another case where a pos vendor was supposed to be sending us aggregate sales data. Again, not in the agreed spec, they included the names of any loyalty users who had used each pos.
I once saw a script kiddie spew a whole credit card file into a non existent endpoint filling the request logs with pci scoped data.
Many web based api (especially json based ones) will not refuse requests that have extra fields in them, so you can get in the case where poorly crafted clients are sending data they shouldn’t.
My point is many many systems don’t ask for personal data and still get and store it.
It's strange that your response to it is "yup, it's totally fine who cares" and not "the systems should be updated to not do that".
My central concern is there is a trade off to be made between keeping the data in place and building a capability to actually read/index the actual personal data. My opinion many times is that not having the technical capability to read that data is often a better privacy control in practice than building it to delete data and hoping it doesn’t get repurposed.
That seems to be a minority opinion here.
I have had similar cases covered by GDPR as well of course but my broader point is that the idea that you only get the data you ask for doesn’t align with my lived experience.