I don’t really feel like looking it up again but the verbiage sounded more to me like they were specifically trying to say that they weren’t setting the GDPR as a minimum standard.

We also have to realize that any privacy policy that is allowing for something out of vagueness is something where you have to assume the worst.