Your solution doesn’t fully eliminate risk on it’s own and addressing that costs money - that’s about as far as a rational company has to go. They know going nuclear and banning all personal info means not having to deal with it at all and it’s a niche thing that will affect negligible amount of users. Bean counting is the core of meeting regulatory and legal requirements in case of for-profit organisations.