For GDPR compliance anonymization may be enough, and that is a different option than deletion if an account is fully deleted than there is nothing left to anonymize.
I’m not a lawyer and not offering legal advise.
One risk to consider is also if there is ever unauthorized access to an account, that would be a problem if account is permanently deleted and cannot be recovered by someone other than the authorized individual for that account.
This may be a reason why they have some safeguards in place and full account deletion must be requested first and then reviewed first to make sure it is valid.