This is more malicious than just not focusing on offboarding. The easiest implementation would be to just delete the user account and abandon the data, slightly more effort would be to delete the data. Making it public with the legal disclaimers and all that takes effort and commitment.
Could very well be, I wasn't there so I can't say.
I have seen good people do bad things out of negligence that later gets attributed to malice on the internet when it gets discussed.
People always drift towards malicious intent but I think it's uniquely terrifying that "good" people can do bad things when the incentives are misaligned, or they aren't thinking end to end, if only because it's an opportunity to admit that we ourselves might make a similar mistake, so we should be vigilant.
