This check: https://github.com/jenkinsci/credentials-plugin/blob/credentials-2.0.6/src/main/java/com/cloudbees/plugins/credentials/CredentialsStoreAction.java#L1011 was a copy and paste of the check in DomainWrapper.doDoDelete() but does not make sense for credentials stored in a existing domain.

It may be the case that the set of domains is fixed by the provider but it is acceptable to remove credentials within the domain and to move credentials between the existing domains