I completely agree. I will probably add a note in the docs to remind people that you should always still perform server side checks.
Client-side validation should always be assumed to be disabled completely - view it as merely a convenience for your users. Help them switch dates into a correct format, make sure their userids aren't taken before they finish filling out their forms, that sort of thing.
I think the parent of your comment was talking about using SSJS to re-use validation on both ends of the pipe.