It's clearly a much better design if the shotguns are pointed at someone else's feet.

no, it's not because the nature of llms mean that even if you fully validate your communications with the llm statistically anything can happen, so any usage/threat model must already take nasal demons into account.

Adding new and innovative layers of unsafety on top doesn’t invalidate the need for safety in lower layers. If anything it makes it more critical.

you're missing the point. the point is, there is no need to make two layers out of one (i could be persuaded that it makes the coding easier)