I do not see how the payer is the account owner. At all. Can you clarify why that would be?
Legally speaking (in german law): The account owner is the person who opened the account, because that is the person who the provider has made the contract with (except the situation of a "Geschäftsbesorgungsvertrag" or a "Vollmacht" [ letter of authorization, power of authority, idk. whats the english term] where you make the contract for someone else). The payer may have a legal connection to the account owner (will, in 99% of the cases, but must not), but not to the provider.
So legally speaking Linode - at least in german law - Linode is providing unauthorized access to a tzhrid party and will be held accountable for all the damages the account owner suffers. That is a violation of GDPR, too. You'd propbably resolve that by a simple letter from your attorney or a court order if Linode does not comply (taking a few days only because of "emergency conditions").
It's not easy to translate all the legalese, I hope you can follow ;-)
When you rent a server, or a VPS, you have 3 contacts. Administrative, technic and billing. Like for domain names.
That way, when a client wants to directly get his own server, they put me as technical contact (and can revoke me if ever they want).
The main contact is the administrative one. It can change the other contacts.
All is clear, and if problems like OP had happens, then someone did a really worse choice
I did some terms in the board for our cooperative housing association (Sweden). The association signed up for a web hosting account. The association paid for the account but a private person had to own the account, which had all the access.
Changing the owner - even if the association paid the bills - was a big hassle and not easy. The hosting company where/are pretty strict about this.
Hence, the everyone in the OPs story made bad choices.
As far as Linode, or anyone else should care, the guy who is paying for the account, owns the account. If he's the one paying the bills, why wouldn't have access to the account?