Allow user to delete their own account from the front end
I think you hit the nail on the head!

Including the userId in the front-end form give them the perfect opportunity to delete whoever they want... even just by guessing random IDs. That definitely seems like a huge security risk.

But if you build your own custom controller, you can guarantee that the current user is the one being deleted.