To be fair to the app dev, I'm pretty sure it was unintentional. Just pointing out it's easier then having to write up a python script and working with apis.

I really don't think most people would expect to have to edit a comment to remove personal info or whatever they don't want people to see

I completely agree with you. Most users wouldn't think that.

I think there'd be much better adherence if people understood how insanely easy it is. "hey guys, deleted comments are still readable" does that convey the same sense of urgency as "clicking this link shows you deleted comments"? I think without communicating how easy it is, people won't worry about it. I know I didn't when I thought the issue was federated servers being able to read comments, instead of literally anyone.

I don't know. I kind of see what you're saying about new attackers realizing this, but this has been a known issue for a long time. Would they really not know? If they searched Google to figure out how to see deleted comments, I imagine you could find the issue quickly. Overall I'm not really a fan of security by obscurity either 🤷. More people knowing how to properly delete stuff is a clear upside too.

And yea, this desperately needs a server side fix and I can't believe how long it's gone on without one. I'm not familiar with lemmy's code base, but a check for if the content is deleted doesn't seem like it would be hard.