Editing app template from Configurable Apps allows the features to be deleted even when the hosted feature service is published with the 'Update Attributes Only' capability.
This issue is not reproducible in the newest version of ArcGIS Online.
When attempting to delete a feature in the Edit app, or the Basic Viewer app, the message, "{code: 400, message: "", details: ["Unauthorized access", "This operation is not supported."]}" is returned in the network traffic for the applyEdits request, and the feature is not deleted.