The author pretty freely admits he shares some blame, having PII on the same phone he uses Lemmy, using Lemmy while not paying attention/being half asleep. I'm sure he does know better and agrees with your statement. And yet, when mistakes happen and people prove to be fallible, Lemmy proves it is not capable of handling the problem.
I also can't believe the Lemmy developers would be so indignant about being presented with such an oversight. GDPR or no GDPR, federated to other servers or not, the idea of PII being hard/impossible to delete from a social media platform is an embarrassment to the developers.