Schema changes are often (normally?) done using a separate mechanism and operations called migrations rather than in the main code. In a production environment

Schema changes are often (normally?) done using a separate mechanism and operations called migrations rather than in the main code. In a production environment they should be well tested before deployed to the live system. That plus backups should help prevent calamities. There are still possibilities of deleting the data whether through the ORM or direct SQL, both could be easily accomplished so test before deployment and keep regular backups in case of disaster.