I tried deleting a non-active website and got: CSRF attempt blocked. Re-enabled it and it deleted as expected. ISPConfig 3.2.7p1/Debian 10
Something in the settings of that specific site or a cookie sent by your web browser triggered the IDS system. Check the ispconfig system log to find out why it got triggered. So neither bug nor feature, just something in your setup triggered the IDS, that's all.
Nope, nothing obvious there. Oh well it's not a problem so no worries. I was using Vivaldi as a browser.