I think you're misunderstanding the nature of these subpoenas. No one subpoenas to get the whole data base. But the company would still have to use legal means to quash the subpoena - so it's in the hands of a judge, not the company (nor LE).
The subpoena is almost always just to run one person's DNA through the system, looking for a small number of hits. Before releasing the info, 23andme sends an email or other communication to the person whose results are being released. IME, if it's not the actual perp, it requires more work on the part of LE (which is easy enough to do and where people like myself come in).