Soft deletes have been popular since the internet became accessible to the average person. When I was younger I was a huge advocate for soft deleting pretty much everything. It felt like the obvious, easy choice - why not retain the data incase you need to use it for something else down the road? It took years to understand the ramifications of storing that data in a secure way really means, and that often times the reason it gets used later isn't something you intended it to be used for when you designed the data structure.

I don't think that way anymore and I truly believe hard deletes should be the default unless you have a very compelling reason to soft delete (and you should usually only soft delete with some guarantee of future deletion via a publicly accessible data retention/erasure policy)