Railway’s “Ship software peacefully” is a good mantra, and they might want to add more protections around very destructive operations.

There’s a lot of blame to be passed around in this story, including OP’s own ways of working. But I agree with them that such destructive operations shouldn’t be in an MCP, or at least be disabled by default.