My suspicious is that 95% of "the industry" does not a give a fuck about their customer privacy and instead just wanted something easy to automate. Plus IIRC there were compliance-as-a-service companies lobbying *for* this rule.