Isn't there an "opt-out override" checkbox on the bulk merge where you have to fill in an override reason? This is what I typically use when I send out stuff like that that needs to go to everyone regardless and then I put in like "critical update notification" or something in the required reason box. I think the argument that "every user potentially needs this communication" is a lot clearer and easier to justify that a change between soft opt-in/out, but I'm still mostly US, so consult your own legal/audit GDPR advisor.