I got the same mail two years ago, I think (haven't kept it, but the "reasoning" sounds familiar).

See, that's just half-truths that amount to lies.

They claim they need to store personal information about you when you're using your personal domain.

That's untrue. Only if you registered the domain with them they would need to know about you.

It's also untrue, because unlike .de, many other TLDs don't require full names and addresses in WHOIS, or there are "privacy shield" services like the one nearlyfreespeech.net is operating.

Security reasons.

Also untrue (although it's a reasonable business decision that they don't want to handle customers calling their support with the customer's own domain set up problems).

I continue to claim that there is exactly one reason they are refusing: A customer with a *@posteo.de address will pretty much never leave.

I wouldn't mind very much if they admitted that, it's certainly a geeky niche to serve, but this security-and-privacy bullshit really makes me mad.

Do you want to trust your privacy with a company that's lying, even if you wanted to argue that it's a white lie?