okay, thank you for your explanation. I couldn't figure out what the author was trying to say.

I'd say internal permission system flawz ... scary.

Not only that, but probably a polymorphism-related error? It sounds like the logic might be that dependent objects/relationships in the graph (like reply comments) were what was intended to be deleted, but links to other videos were considered dependent relationships and needed to be deleted as well.

That's a commong thing in permission / capabilities. Either the system is not expressive enough, either you get "false positives" and bounties included.

or maybe insecure direct object reference?