It's no different than stuff like not trusting browser input or avoiding a massive session when you're working on a Web app: it's simply basic best practice stuff that you don't even have to think about if you have an idea what you're doing.