Input validation is a separate thing. If a user provides bad input, yes, the server should return an appropriate error code and human-friendly message. _Lacking

Input validation is a separate thing. If a user provides bad input, yes, the server should return an appropriate error code and human-friendly message. _Lacking_ sufficient validation is a problem that could result in an internal server error that could be resolved by changing inputs, but the validation doesn’t exist so the server cannot inform you of this.