Even with this capability disabled for the users role, they still see the option to delete the response. It doesn't actually do it (it silently ignores it). I guess there's two things here...
1. You shouldn't get the option if you don't have it
2. The check for the capability when the action is carried out should actually generate an error if it isn't allowed.