Does this not seem like a security and management issue to everyone?

If you cannot delete Users then site management can become problematic for admins as you can end up with a bunch of disabled users clogging up the system after a few years.

A solution would be a disable and make invisible unless you select a checkbox to show disabled users, this solution would also mean record consistency and no orphan records.

You could also permanently "delete" a user by using a separate table for these deleted users, thus removing all accesses to the backend but keeping the ability for records to reference the former user.

Having the disabled user in the DB with login name and password is a problem that should be really be looked at in my opinion.

Also allowing users to change their own email addresses without having access to all users would be great.