I have seen this come up periodically, and it seems to be the case that for various reasons soft deletes are the way it is actually done.

here is one not particularly recent discussion https://news.ycombinator.com/item?id=954393

Now that I think of it I would probably have done soft delete if I got around to automating deleting accounts at my old startup for lots of reasons.

on edit: another more recent article https://news.ycombinator.com/item?id=23005060