It's a pure style issue, but I really don't like using strings where it can be avoided:

This could just be written as:

$canExecuteModification = $requires_controller ? $current_user->canDelete($user) : $current_user->canUpdate($user);

or a variation thereof.

It's IMO easier to read (I know, subjective), but it also allows typecheckers/linters/autocompletion etc to function.

Obviously not a blocker.

This seems like an indirect check. Non-controllers cannot delete, therefore we use this to check if they can modify the config here. I think it would be better to have an explicit isController check, or at least supply a comment what we mean to be checking here.