In the "controlled" scenario described above, I presume the DPO would contact the hosting provider if changes to models were wanted?
It seems like we have enough consensus at this point to file a ticket. Could you do that, please? As the end-user raising the issue, I think you should be the initial filer. I believe we mark GDPR-related tickets, so I'll make sure that gets done as soon as I know the tracker number.