One thing to keep in mind is that there are a couple of million Wikimedia accounts. Just by the law of averages, it's likely that someone who has a Wikimedia account dies every day. Most of the time, we will never know about it. I'd guess that a good percentage of the accounts that have been inactive for 5-10-15 years belong to people who have passed away. The vast majority of accounts of deceased editors have no potentially hazardous permissions attached to them - there aren't *that* many administrators, interface administrators, checkusers and oversighters across all projects - so there is no significant risk in leaving those accounts active. There is no real security issue here. The main effect of having a "deceased user" right would be to highlight which users were popular enough to have their death noticed by their community; most accounts of deceased users will never be identified as such.
I've explained the "process" of how we address things on English Wikipedia, but not even we have a formal written policy on this; as best I can tell, most of the steps I've mentioned aren't written down anywhere, and it is simply a practice that has developed over time and is passed from one "generation" to another by example and word of mouth. In fact, I'd guess that very small projects (where almost all the editors know each other) are even better at recognizing the contributions of deceased members than any of the big projects. I'm in favour of individual projects, which all have slightly different cultures, developing their own process, but I'd suggest it be a guideline rather than a policy.
Risker/Anne