One thing I don't understand is how you're supposed use a database with no access control in production in the first place.

Do customer-facing applications run using keys with the same ability to delete databases?