My question, as always in these cases, is what guarantees are there that this data is actually deleted?
Maybe I'm just old but... look, somebody owns the drives. "No longer visible in the public interface" isn't "deleted", somebody always owns the drives, somebody was responsible for disaster-recovery and backups, somebody was testing against a db clone on a developer machine. There is always somebody doing all of these things.
Deleting data is hard now, for real.
@mhoye even if nobody intends to buy the drives to get the data, they'll get recycled and it won't have been anyone's job to wipe them and like a decade later @foone will post another "it has been zero days since I purchased some recycled hard drives that were full of pii" thread.
I guess that's the best case scenario.