Agreed, There should be a merge permission. Just had to deal with a nightmare with an employee that merged unknowingly, costing us hours of creating new contacts, deals, companies.
OR, just create an “undo merge” button. Either one will work, But this is a necessity.