While we test some code, we deleted all full access keys of some NEAR accounts, and that account looks to be dead now.
We’re just curious why this is not forbidden. Is it useful somehow? It seems it could lead to catastrophic consequences for the user loosing control over their account.
While it is not useful and dangerous for a regular account to get all its access keys deleted, it is a common pattern to create an account, deploy a contract, and remove all the keys from the account to prove that nobody can redeploy the contract anymore. You can find a number of examples on NEAR mainnet already, e.g. staking pool contracts are deployed and "locked" this way staked.poolv1.near. See more details about locked contracts in this answer.
Account in near may hold a contract, so there is no special case for contracts vs regular accounts. If there is no contract and no access keys, it is a dead account, indeed, just like an account with a key the private key/seed phrase of which is lost.
The cool thing about NEAR accounts model is that you could setup a backup key to the same account and all your assets are attached to the account id, so you can add new keys without a need to transfer all your assets.
Basic concepts documentation is a good starting point to learn more about accounts in NEAR.
Named account model should be quite familiar to anyone who used to work with Web2 apps, where users usually use their usernames as identifiers, and when sign in, server generates a session token. NEAR accounts model is almost the same where instead of some random session token cryptographic keys are used.
I also believe that smart contracts holding fungible tokens or non fungible tokens should delete all access keys. Otherwise, it would be possible to change the contract, and modify the ownership of the tokens.
