> A malicious client will circumvent rulesets you have in place. If you do not validate client inputs, you will be exploited.

I agree. That is why there is still serverside enforcement, but performance tuning is heavily cache based and many client request strategies are specifically designed to not bust the cache and cause a high latency call.

Also, in our case, the app is the product. I'm not very positive on it's market fit, so you may never hear of it if it launches to a fizzle, as I suspect is a large probability.