Whenever I've implemented undo (or undelete) there's always been a horrible nagging feeling in my head of "What happens if there's a data breach before something gets hard deleted?" People will expect their deleted data to have been properly deleted. If they discover that it wasn't then regardless of how well I explain how undo features have to work there will always be some users who think I lied about the delete feature.
It also makes things like GDPR and erasing people's data a little harder (although not much).
Hard delete also frees resources immediately, which can save some money at scale.
And, ultimately, most users don't expect it in a web app, so you can save time by not building it.