> Is there some legal mechanism to compel companies to delete your data rather than this "soft-delete" garbage?

You could take a copy of the original e-mail and a copy of the notice and send them, with a cover letter, to your state securities regulator [1]. If you want to turn up the heat, submit a complaint to FINRA [2]. If you want to be peskier, and live in California, submit a CCPA complaint [3].

[1] https://www.nasaa.org/contact-your-regulator/

[2] https://www.finra.org/investors/need-help/file-a-complaint

[3] https://oag.ca.gov/contact/consumer-complaint-against-busine...