Completely in that they do not delete it. Regarding the legal aspect I am not a lawyer.

Messages can contain personally identifiable information and they very often do. You cannot anonymize messages by just deleting the user name and email address of the sender. With Reddit the difference is that it is public in the first place while with direct messages you have anexpectations of privacy. But of course how things turn out in court is another matter.

GrapheneOS is the go to recommendation.

Hope this gains some traction. We really need to move away from Reddit.