Likely the penalty for not retaining the data is less severe than any penalty for getting caught with evidence of illegal actions, so it's the default action to reduce risk when you're doing illegal shit.

I presume longer retention policies apply to specific data rather than arbitrary communications. The place I worked with a 90 day deletion was maniacal about adhering to the letter of the law and they didn't seem broadly concerned about any data that was solely in email.

Well until they went to sue someone else, then they'd grab and freeze all email boxes that ever communicated with the defendant and instruct all parties to immediately forward any email from that party to legal and ignore it.