To check a plan on production you run EXPLAIN ANALYZE DELETE FROM sessions WHERE expires_at < now();. What happens?

The correct answer is "The DELETE really runs and the rows are gone, unless you wrapped it in BEGIN and ROLLBACK". Plain EXPLAIN only plans the query. EXPLAIN ANALYZE actually runs it to measure real timings and row counts. Side effects happen too, so the rows are deleted.

So "Only the plan is printed; nothing is deleted" is wrong: that describes plain EXPLAIN. To analyse a write safely, run it inside a transaction and roll it back. Plain EXPLAIN would have been the safe choice here.