Careful using only Current User's X in privacy rules

So this topic was just highlighted at Bubblecon by @wesleywsls , and the solution offered was to add an extra condition on privacy rules saying “and is not empty.”

Do we know if this still works for “Created By?”

For example, if you delete a User, how does it affect “This User is Current User” ?

You could argue that there will never be a “Current User is empty” because even anonymous accounts have a Current User, but what if someone isn’t visiting the site from a browser and is just querying the API directly?

Should we be adding a condition that says the below?

Do we think this is bulletproof and robust against deletions? Would love to hear your thoughts @georgecollier @nico.dicagno

and Creator is not empty” to all datatypes where This User is Current User is set