Nonces are not permissions — check both

A nonce proves the request came from a form your site rendered, recently. It says nothing about whether the person submitting it is allowed to perform the action — and a valid nonce is issued to whoever loaded the page, including a subscriber who should not be deleting anything.

if ( ! isset( $_POST['_wpnonce'] ) || ! wp_verify_nonce( $_POST['_wpnonce'], 'delete_order_' . $id ) ) {
    wp_die( 'Bad request.' );
}

if ( ! current_user_can( 'edit_shop_orders' ) ) {
    wp_die( 'Not allowed.' );
}

Both checks, every time: the nonce for CSRF, the capability for authorisation. Tying the nonce action to the object id — delete_order_91 rather than delete_order — stops a token minted for one record being replayed against another. Nonces expire after 24 hours, so anything long-lived needs a different mechanism.