“Whether you need the input validation Depends on the the nature of application that you're building, how you define the trust boundaries, where the data is coming from.”

Transcript evidence from Mehran Koushkebaghi -- Security as a Systemic Concern: How to develop Anti-Requirements.