It depends. Of course, if i.e. a malicious ciphertext can do an RCE, the app right now is not vulnerable. But at some point you might let the user backup his en

It depends. Of course, if i.e. a malicious ciphertext can do an RCE, the app right now is not vulnerable. But at some point you might let the user backup his encrypted data and restore it. You colleague knows you already have the code, it's only decrypting the data, you checked it for security, what could go wrong? Of course, you shouldn't panic just because this issue exists, especially if you know it does not affect you right now. But leaving this unattended, especially without the huge exclaimer that you can not accept untrusted ciphertext, can easily come back to bite you. Maybe it was exactly what caused this (theoretical) issue in the first place.