action.destructive_requires_name has been something that everyone should run in production for safety reasons and now that the default changed from false to true I think it should be a static module (probably in the next major release as it is a breaking change) so that you can protect against a lazy developer rescuing, updating settings, and making the request. It should be a setting that should be changed with a lot of thought and disruption (rolling restart) convincing them that a better solution is to simply have a query builder return a list of indices to delete and delete them in circumstances where you need regex expansion.