You must be aware that Square is operating a service in a regulated field (fintech) and that openly advertising their possibly illegal business practices is not to their advantage. Let's assume that everything you've said is true that could come in handy one day when a regulator is looking to determine the difference between whether this is an oversight or willful. You are making their job a lot easier and Square's situation a lot more difficult.

For your sake I hope that Square plays it as much as they can by the book, and that if they don't that this will cause them to wake up to the fact that all it takes is one employee blabbing online to get them into seriously hot water.

People here are on average quite aware of how data is stored, but they are not always empowered to make the call on how it should be stored. As long as that happens behind the curtain it is a problem, but not a huge problem for any particular company.

You have just raised Square's profile in many ways at once, not in the least by alerting the hacker community to the fact that Square has a lot more data than they should and that their security measures are not exactly top notch. The consequences could be substantial especially when that deleted data turns up in a dataleak. When you represent your employer online be careful about what you say and write.

I assure you nothing Square is doing is illegal or even "possibly illegal". Square takes GDPR deletion and right to be forgotten incredibly seriously. But you must understand that soft-deleting an image that the user uploaded is not in violation of any regulation in place in the USA.

"I'm trying to inform folks about data deletion works."

Is hard to reconcile with this comment.

Whether data is an image or some other record is immaterial. If the user (or the controller, for that matter) tells you to delete their data you delete it. Full stop. That's the right thing to do and in many places now a reason to get fined if you don't. Whether your company is based in the USA or not is immaterial.

You also responded to an inquiry of Facebook employees as though you were one, when in fact you work somewhere else entirely. I think you mean well but possibly do not understand the implications of your statements here.