A bit more background:
There is a parallel discussion happening about schools and their teaching tools during lockdown/school closures. (Both schools and universities in Germany are owned by the Länder.)
One example that made it into the media quite prominently was a school in Berlin that got an official "Warning" by the Datenschutzbeauftragte (privacy protection office) who explained that they received a complaint and had no choice although they'd have liked to actually help the school to arrive at a working and privacy protection law compliant solution. The same would happen to any university if a student complains and the privacy protection office then finds that the "legal homework" was not done on the side of the university. Which is of course a possibility that scares administration.
There are lists available (the ones I've seen are all in German, though) with cloud services where the data protection offices wrote down their take on whether the particular service is compliant with German law (and in turn EU GDPR), can be made compliant (by adequate service contracts) or whether and which fundamental concerns they have.
Maybe not too astonishing, the cloud service providers who most easily meet the German legal requirements tend to be Germany-based - I don't think it can be a surprise that companies tend to know the legislation in their home market very well.
The other legally easy option is for the universities to run these services themselves, this saves them from needing to put in place appropriate contractual agreements for 3rd party data with the service provider. And since universities have computation centers that are anyways in place to run IT services as infrastructure for the university and they are organized in the DFN which has R&D projects on such infrastructure, this is an obvious way for them to go.
In general, German legislation is very picky about abuse of power, and this reaches out here where students cannot refuse to use certain services the university (or school) prescribes. Universities are run as a public service, and they are held to the standards any governmental office must meet. "Agree to this tool's service terms or leave university" is not regarded as a fair choice.
All this applies mostly to teaching.
In research, one may presume more liberty in a group of collaborators agreeing on which service they use. Which I think in turn allows more leeway in the choice of tools and services. Of course, your collaborators may prefer to not need yet another tool or service an addition to what is prescribed (or approved) by their university for their teaching duties.
A separate topic is the research institute's policy about their own data. I don't know whether German institutes tend to be more protective than others (and my experience could at best be anecdata anyway), but I've met increasing concerns about this, including restrictive policies which I'd have expected in industrial R&D rather than in public research.
The increase in concern may be spurious in the sense that the underlying concerns about when to share with whom may have been constant all the time and just haven't been relevant (and therefore not expressed) before sharing became so easy with free public cloud services.
On the other hand, IP protection and patents, licensing and generating spin-off companies have become more important for academia and public research also in Germany, so increasing concerns about uncontrolled sharing may reflect this development.
Germany has very hierarchical structures in academia, so these policies may be very much a matter of the personal opinion of the respective professor or institute director (whose power does include a whole lot of decisions to not share).
... and due to the complex legal situation, said professor or director may have decided that the most economic way of dealing with all this is to err on the safe side and be very restrictive for everything but what is offered by their university IT services - which is implicitly safe because the blame would go to the university rather than to them.
What recommendations are out there
The official recommendation to use a privacy friendly meeting organization tool (such as the DFN one or the TU Dresden one) rather than doodle has been around for many (IIRC 10+) years.
Also orders to not to use Skype, Dropbox, Google Drive, whatnot have been a regular part of the data protection lectures/readings I've been required to attended at various German research institutions for many years (mostly not universities, but public research institutes).
Many universities have lists with more or less general/detailed recommendations out by now, the BSI (federal office for information security) as usual has general guidelines.
However, almost all the documents I've seen in this context are in German.
As an example, the university Duisburg-Essen (random find on the Internet, I have nothing to do with them) has an internal document with a table listing some popular but critical services and alternatives
GDPR/German data protection law compliant solutions exist, and sometimes the solution could also be saying "those who (and whose institution) are OK with using Doodle, go ahead. Everyone else, please email me your preferences"