“Deletion of data and a possible fine.” Oh no, how will the billion dollar company cope with a $2m fine that all goes to the corrupt government officials anyway.
To answer the "big question", "Why Android even allows this" I asume you are taking about the Android versions that are coded to allow this. In this case it is because , well, are coded like this. Why did Google coded their Android version like this? Profit.
Apple, doesn't code ios like this cuz it is not their big revenue.
I am not sure Google or Apple are the hero in this story. Insinuating Apple does it out of the goodness of their hearts is naive.
I can imagine that spammers nowadays can write a simple script that drops everything from the + to the @, so while that may work for some spammers, others will just use your normal email address. I've resorted to creating a catchall for my personal domain. Also not ideal, but it'll hopefully take them a while to figure that one out for everyone using their own domain.