Missing capability check for delete backup

We should check a user is authorized to delete backups before performing the action. Should we use custom capabilities?