Mastadon works the same way, all ActivityPub services work the same way.

By being Federated that means data is being sent to remote servers. Sometimes that data doesn’t always make it, like a delete request. So someone on their own home-server deletes their post, but on some remote server where that post they made is cached, it’s not deleted, because the delete request never federated. For example, say you made a post on your own box, which you clearly have, and you delete a post, but it doesn’t get deleted over on say, Lemmy.world. That’s not purposeful, that’s something the developers also trying to fix, so I think it’s disingenuous to say they don’t care.

This is literally a consequence of how federation works. It’s not a purposeful violation of GDPR.

You may not be directly using it, but this is part and parcel of the entire point of federated social media. Other software will be accessing the pool.