In the code I've written that deletes directories, I never call the system level delete functions directly, and instead have abstracted them away to a function

In the code I've written that deletes directories, I never call the system level delete functions directly, and instead have abstracted them away to a function with added checks to the beginning that fail/assert with big warning messages if parameters ever try to delete root or other system directories. It's never been triggered except by my unit tests, but I'm sure glad it's there.