As far as I understand it (I never fully read the ActivityPub spec, so I’m talking out of my ass here), it’s impossible to completely delete data because some instances might choose to ignore the Delete request, keeping the data on it’s internal records.

Not sure what they’re addressing other than comment/post permanence. I don’t totally see how that’s a direct connection to privacy

This is the case with every hosted service. It isn’t a choice, it is just how data storage works. Things are always saved on someone else’s machine. Or, in the case of federated systems like KBIN or Lemmy, many people’s machines.

Your data is open and accessible to all. That’s the entire point of federation. Nobody owns it.