Does an export include everything a service knows about me

It includes what they classify as your data, which is narrower than what they hold. Derived profiles, inference scores and internal logs are commonly excluded. The gap is legal rather than technical, so the practical move is to compare the export against what the interface shows and note what is missing.

Doing it once and never verifying. The setup is the visible part, so it gets attention, and the check that would catch a silent failure never gets written.