Yes. Having the safe thing and very dangerous thing just be a boolean flag apart is bad. It increases the odds of the wrong flag being used at some point. It's

Yes. Having the safe thing and very dangerous thing just be a boolean flag apart is bad. It increases the odds of the wrong flag being used at some point. It's also not clear from the post if someone had used the "permanently delete" flag accidentally before. It's very possible they had, but hadn't ever run it on a wrong id before. While yes, someone ultimately did hit "enter" on a command with the wrong ids and the wrong mode, the existence of such a script enabled that mistake to have enormous consequences. Calling such a script "faulty" feels reasonable. In the same way having tooling which allows you to delete prod database disks without any additional safeguards would be called faulty.