You'd be surprised how many applications and web sites still rely solely on client-side validation, even these days. Either don't think at all about threat scenarios ,or they trust their "Do not reverse engineer" EULA to protect them :-)