The assumption seems to be that the undelete operation is performed by the vendor's support staff, rather than the end user. I've been involved in the implement

The assumption seems to be that the undelete operation is performed by the vendor's support staff, rather than the end user. I've been involved in the implementation/ maintenance of systems with soft delete that was entirely for that purpose - it allowed the user to delete/undelete at will. In our case it also meant certain uniqueness constraints were kept in place effectively reserving things like email addresses or business registration numbers that couldn't be reused until a hard delete was issued. Arguably it's more like an "is active" flag in such a case, but it's debatable what the distinction is.