Shizuku is open source and safe in and of itself. The apps that make use of it however have the potential to do a lot of stuff, which is the point, and so must be checked thoroughly.
Email works the same way. Once your data is received by the other party, you cannot delete it.
Public mailing lists have a very similar behaviour to the fediverse’s. I am not aware of any credible GDPR cases against those, although it may happen down the line, we’ll see.
Even if it is, this data is not processed in a way that would violate the law, unless the hosting party is doing something shady. It would be an incredible stretch to consider that a website only asking for a username to attach to a user somehow violates GDPR.
I understand this is hard to prove without doxxing. This situation is very concerning, and if true absolutely disgusting.