Doing a quick test in my local development, this looks safe for that specific case (auto-approve vanish requests when user hasn't done anything)

• The admin has the permission to delete only the global account for the user, which makes that user a local-only
• If that user logs in the system auto-creates a global user for them

So the user cannot exist only locally AND request a vanish (to be auto-approved).

I'm not sure if there's another edge case in which a user (local only, not global) can request a global vanish.