Thank you for your answer.
The issue with your example is that you have used internal versioning and you are not aware of that. The document was not existing before you created it so the internal versioning have given it the same version number 1. That is also the same number as you have filled as an external version but they are not related. If you would have set external version to 3 you would still get response that the document is version one. Second call fails not because of version conflict, but because create is checking if the file is not already created.
I would say change the bulk request to something like this
$ curl -XPOST "localhost:9200/_bulk?refresh=wait_for&pretty" -d '
{"create":{"_index":"index","_type":"type","_id":"1","_version":1,"_version_type":"external"}}
{"data":"test data"}
{"delete":{"_index":"index","_type":"type","_id":"1","_version":2,"_version_type":"external"}}
{"create":{"_index":"index","_type":"type","_id":"1","_version":1,"_version_type":"external"}}
{"data":"test data"}
{"delete":{"_index":"index","_type":"type","_id":"1","_version":2,"_version_type":"external"}}
Seems dumb but simulates multiple conflicting requests sends to the server. It should create a document with version 1, delete it with version 2. Second call to create document with version 1 should fail due to version conflict, but it instead creates document with version 3 because create uses internal version system so it just increments the number instead of using the external. Second delete will fail because of version conflict. So expected result would be deleted document, but instead of it we have a document with version 3.