I see your point, but there is nothing in the above which protects against "nefarious admins". My business account was previously on GSuite where the act of transferring data from a deleted user was to simply check a box and specify a destination email address.