> Why do these systems hold onto user's data post verification?

Depending on the company, you could rate the reasons on a scale from "incompetence/naivete" to "revenue stream".