Understanding S3 Bucket Deletion Permissions: Am I Misunderstanding Non-Versioned Buckets?

I recently encountered an interesting challenge regarding how Amazon S3 manages delete permissions on non-versioned buckets. I always thought that applying a policy to deny delete actions would be straightforward. For instance, I typically set this deny policy for my non-versioned S3 buckets, like so:

```json
{
"Effect": "Deny",
"Principal": "*",
"Action": "s3:DeleteObject",
"Resource": "arn:aws:s3:::my-bucket/*"
}
```

This makes sense to prevent deletes, right? Well, I found out that while this does deny deleting an object normally, if you try to delete the "null version" of the object, it unexpectedly goes through:

```bash
aws s3api delete-object --bucket my-bucket --key delete-me.txt --version-id null
```

This problem arises because it's using the `s3:DeleteObjectVersion` action, even if my bucket has never been versioned! I noticed this quirk while using the "Empty bucket" option in the AWS console, which calls this null version delete, and it left me puzzled. To properly handle this, I realized I need to include both actions in my policy:

```json
{
"Effect": "Deny",
"Principal": "*",
"Action": ["s3:DeleteObject","s3:DeleteObjectVersion"],
"Resource": "arn:aws:s3:::my-bucket/*"
}
}
```

Is anyone else aware of this oddity? Did I overlook something obvious in AWS documentation regarding this?