Yeah. NordVPN is an example of this handwaviness. They refuse to delete my account to which I can successfully log into and which I've never used because they claim that as "a security-oriented company we do not take account change or deletion requests lightly, hence we request payment information to confirm ownership of the account, as we would not want anyone but the rightful owner making such changes." Problem being, I've never paid NordVPN, and when I told them as much and asked what security problem could result from them deleting an unused account, they didn't respond.