Is clicking delete enough

It starts a process with a retention window, typically 30 days, during which recovery is possible and so is a breach. Export first, then delete, then check back later that the account is actually gone rather than merely hidden.

At ten times the size the bottleneck moves from the operation itself to what it competes with: memory, locks and the people who have to run it. The approach stays, the batching gets smaller and the schedule matters more.