shared responsibility model understanding confirmation

For (1) the general answer is yes but there are nuances which put some responsibility back on the customer. For example, if you are running a database using RDS and you delete a row of data from that database, the deletion of that data is under the control of the database (and the database policies) which are a customer responsibility.

But if you were to delete the RDS instance (which deletes the underlying EBS) volume then both (1) and (2) are true. Similar for EBS volumes attached to EC2 and other services; as well as services like S3. There are likely many other more specific use cases.

So the answer here is that (1) and (2) are true but you should check which services you're using to ensure that your requirements are met.

The best thing to do here is to select a compliance program that meets your security needs; then use the AWS Artifact service to retrieve the latest documents for that compliance program. Those documents attest that AWS is complying with the controls listed in the program. Most (if not all - I haven't read all of them) security programs have a secure deletion policy.

Then, check the compliance program for the services that you're interested in.