That is an appalling state of affairs. I hate to jump to conclusions but it smacks of the stereotypical “techbros think they are above the law and just don’t care”.

The smallest charity which keeps personal data seems to know their responsibility under the GDPR. Wordpress certainly should.