In order to delete any content owned by a user, the Google bot would have to have logged in as that user first, which seems unlikely - so long as all destructive actions are behind access control, which they definitely should be already.
This is very far from true. Failing to implement access control or even authentication on POST is a routine error even in applications built in the last couple of years.
Less facetiously: the Googlebot isn't making random POST requests, it's just executing Javascript on the page. So not only would you need an unprotected POST /comments/1234/delete endpoint, you'd also need to serve the UI and Javascript for POSTing to that endpoint to an unauthenticated user.
I'm sure there are still people out there doing that, but at least it's more than a simple error of omission.
