Trust is relative, of course; one should be extremely wary of data that came from an external user, or a client-side application. None of us would say one shoul

Trust is relative, of course; one should be extremely wary of data that came from an external user, or a client-side application. None of us would say one should naively deserialize such data. But then there's data that comes from another team's server calling yours as a service; or from another server internal to your service; or off an internal message bus; or from one's own database. Each of these has a different degree of trust, and different considerations to weigh.