They don't have to do anything technically - they are free to leave the game Goat Simulator buggy or turn the next one into a kitten petting simulator. But there are consequences for that. As long as they care about quality or at least success providing support and properly setting access permissions and securing their architecture to not do things like trust the client is important.