Is there evidence that European courts have sided with that? “We’re holding onto all your data indefinitely just in case you log in again several years from now” seems to be the antithesis of GDPR and I can’t discern the difference between that and what you’re suggesting.

I believe EU has dug their own hole here. And the best move would be to pass more legislation to explicitly require the retention (and transfer, ideally) of purchased digital goods.