I encourage you to read my comment again, and point out where I mentioned merely setting a delete flag. Any reader worth their salt will point out that it’s not what I suggested at all.
I believe the confusion is around your statement "mark every sensitive field". I think you mean "overwrite every sensitive field", but that definitely took a re-reading to infer, and I'm still not 100% sure.
Thanks, the processs reminded me of the “redaction” process, so I used mark. That’s definitely on me. Clarified.
"you could easily not switch to a CASCADE, but instead set delete=1 and mark every sensitive field with a special value"
you ignored "and mark every sensitive field with a special value", which is the key part. As long as all sensitive data has been essentially zero'd out (for some value of zero), all is fine.
Marking a field sounds to me like labeling and not zeroing it out.
What if "a special value" == NULL?
If you choose that value, and it's the only, or one of the few values that break your software, then it's your fault.