I'd say its less about writing defensively (protecting yourself against libraries who don't deliver what they promised) and more about users making stronger assumptions than what the library promised (eg assuming json string literals contain no escaped characters so that a simple ". *?" to match the value is fine, that some value is always defined or generally that a behavior observed two out of two times must be the rule).