I think the crux of the argument is summed up here: > Developers could theoretically build an ECC implementation with terrible parameters and fail to check for

I think the crux of the argument is summed up here: > Developers could theoretically build an ECC implementation with terrible parameters and fail to check for things like invalid curve points, but they tend to not do this. So, it's just about trusting developers to implement a different algorithm properly.