“Deletion of data and a possible fine.” Oh no, how will the billion dollar company cope with a $2m fine that all goes to the corrupt government officials anyway.
To be fair, GDPR fines can go up to 2% of worldwide revenue. Meta was hit by a $1.3G fine just this year, which for 2022 fiscal year ($116.6G) accounts for 1.1% of their revenue.
But yeah. Most fines are mostly just the cost of business for those billionaire companies, and the ones that may not be, the army of lawyers they pay a fortune to have on payroll to fight tooth and nail against them, that must logically be cheaper than what those fines really end up costing them, should give a hint.
To answer the "big question", "Why Android even allows this" I asume you are taking about the Android versions that are coded to allow this. In this case it is because , well, are coded like this. Why did Google coded their Android version like this? Profit.
Apple, doesn't code ios like this cuz it is not their big revenue.
I am not sure Google or Apple are the hero in this story. Insinuating Apple does it out of the goodness of their hearts is naive.
One tip for ousting certain leaks is with gmail you can setup an email address like youremail+scummycompany@gmail.com you just have to forgo the login with google bit
I can imagine that spammers nowadays can write a simple script that drops everything from the + to the @, so while that may work for some spammers, others will just use your normal email address. I've resorted to creating a catchall for my personal domain. Also not ideal, but it'll hopefully take them a while to figure that one out for everyone using their own domain.
A better tip is to buy a domain with an email forwarder configured. I have an infinite number of emails and I can see who's selling my data by checking what the email user is set to, since I usually sign up with an address related to the service I'm using.
Some apps let you create an email account first then link socials/OAuth providers on top, so there's that. But other times it's indeed a good solution. Unless the site uses validation that doesn't allow for subaddress extension.