Programmers should be more careful but then again footguns exist (or in this case legcannons). You shouldn't trust any 3rd party data before validation but how

Programmers should be more careful but then again footguns exist (or in this case legcannons). You shouldn't trust any 3rd party data before validation but how do you validate it if you can't even deserialize it to see what it contains? It's silly.