If it were common sense to do it, they would have done it. It's not. It's a very distinct thought pattern shift from "the browser is a part of the execution of our code and it will only try a delete link which the code has generated" to "the user can request anything at any time no matter what links we have or haven't generated or what they can see on screen".
It's a learned shift specific to some subsets of some kinds of computer programmers, not at all "common sense".
(and besides, even if it were common sense, what's the point in your comment then?)