Definitely agree that you should have validation if you can't guarantee the validity of your data, but I think there's a difference here.

Coincidentally, I had a discussion about a similar topic today. Basically how much validation is necessary and at what level should it be at?

  function add(a, b)
    if a is not a number
      throw error
    if b is not a number
      throw error
    result = a + b
    if result > max possible precise value
      throw error
    etc...

I would never have these checks in a function that just added numbers if I could guarantee that any values passed to it are correct.

The team in the article said that the config shouldn't return null so they didn't put checks before using that value. To me it seems like they missed necessary validation logic because they didn't the realize the full extend of the config.