You turned off updating and deleting in a Feature Layer. You put an Edit Widget in Experience Builder and what's that Delete Button doing there? And it works, too?
Two important questions:
- Do you own the data layer?
- Are you an Admin on your ArcGIS Online/Enterprise Portal?
If you answered yes, to either of these questions, that's a quirk of the ESRI ecosystem. It's not just limited to Experience Builder. If you own a data layer or you're an Admin, you can always do whatever you want to the data even if it's not allowed for other users. It's on one hand a very sensible and on the other very poor design choice by ESRI. Afterall, if you are an Admin, you may need to delete some bad data maybe even against the will of the data owner, but being an Admin doesn't make you immune from "Oops, wrong button syndrome". Try logging in as some other user and the Delete Button should be gone.
If you're not an Admin or a data owner, contact ESRI Support. Something is very wrong.
Edit: Here's an official quote about this issue from the JavaScript API documentation.
Authenticated users that are layer owners, administrators or users with full editing privileges will have their elevated user privileges applied in regards to editing behavior and data access. This mimics the behavior available in Map Viewer. To opt out, set esriConfig.userPrivilegesApplied to false.
Note that last line. If you are on Developer Edition, there is a way to opt out of your elevated powers.
