I suppose they could have logged only if a bot token was detected in output. But if you'd think to do that, then why not also just block the output?
Comprehensively unaware of the GDPR enforcement process also.
What will you google next, I wonder?