If the company is storing Personal Data (on people in the EU) or is present in the EU, GDPR applies. They might also be complying voluntarily for various reason

If the company is storing Personal Data (on people in the EU) or is present in the EU, GDPR applies. They might also be complying voluntarily for various reasons. Data Subjects' rights to their data aren't absolute. If you need it for legal/compliance reasons, or legitimately need to keep it for clearly defensible reasons like auditing, preventing fraud, etc., you aren't required to delete it. But if your only legal basis for processing the data was Subject consent, and they revoke their consent, you are required to delete it. Many companies are treating mailing lists this way and/or are confused and terrified in general, so everyone is getting emails. Some companies are also adding Data Processing Agreements to their terms of service that allow them to be Data Processors for customers. Maybe your MFA vendor is one of those.