If I am not mistaken, CiviCRM will (at least via the UI) does not allow contacts with live finacial transactions (so everyone with a completed donation) to be permanently deleted, unless you delete the contributions first.
This way, accidental deletion would not be possible and you can always not grant users the permission to delet contributions...