Deleting users who have written nodes/comments can lead to access bypass

Drupal sites can allow users to be deleted or even for users to delete themselves. This can sometimes lead to unexpected situations where anonymous users (i.e. the whole internet) are able to view or edit pages on the site which they otherwise shouldn't be able to see.

Suggested solution

Be cautious when using the "Cancel Account" functionality on /admin/config/people/accounts. The option for "Delete the account and make its content belong to the Anonymous user." may pose a security risk based on the configuration of your Anonymous user permissions.