destroy_function.py

...
from rest_framework.permissions import IsAuthenticated
...

    # Add this to the UsersViewSet
    def get_permissions(self):
        if self.action == "destroy":
            return [IsAuthenticated()]
        return super().get_permissions()

    # Add this to the UsersViewSet
    def destroy(self, request, pk, *args, **kwargs):
        """
        Deletes an authenticated user. Requires authentication.
        Only a user can delete its own account.
        """
        user = request.user
        if user.id != int(pk):
            raise ValidationError("Only a user can delete its own account.")
        user.delete()
        return Response(status=status.HTTP_204_NO_CONTENT)