Argument passed in must be a string of 12 bytes

In your database you have an object whose _id is of type string.

In your query, you're casting (presumably) a string to an ObjectID, which is an object. Not only is the argument you're passing to ObjectId() not something that it supports (as the error indicates, see below), even if it would be valid, the query would result in 0 hits: after all "TZ23c" !== ObjectId("TZ23c").

Simply change .deleteOne({_id: ObjectId(toyId)}) to .deleteOne({_id: toyId}).

ObjectId() either takes no argument (it will return a new value) or it takes exactly 12 bytes (24 hexadecimal characters), for example: ObjectId("61e16f21f82a9db6a2094e78").

An ObjectId's string representation (ObjectId().toString()) is not an arbitrary string of characters: it's a timestamp, some values that identify which server generated it and some random values to prevent collisions. Not every string is a valid ObjectId.