> This idea that those vendors ought to be required to delete records seems backwards

GDPR doesn't introduce a requirement to delete data upon request.