> Often, imo, this depends on where you want to put the validation complexity. You can move validation to the front end

This has nothing to do with the frontend/backend split since a server will receive arbitrary requests, not just the ones you hope you programmed the frontend to send.

> In theory it sounds great to say "just prevent construction of bad states," but this is a complex problem in professional software

Defeatism.

If you have a User in your domain, and your domain dictates that Users have a UserId, simply do not allow construction of a User without a UserId. What's a UserId? Is it a String, or is it a UUID? If you think the King James Bible translated into Chinese makes for a good UserId, then a String is a perfectly good representation for that. Otherwise pick something more suitable.