I think the idea is that you validate the data once, on an API level. You don't need to validate the same data again after the initial inspection.
In our team we use io-ts to validate all of our endpoints, but simple type guards could achieve the same goal.