Wild speculation here, but I suspect the developers were of the opinion that "We only receive data from trusted sources, so we don't have to bother validating stuff", which if it is the case would be a tremendously bad take by the developers because your upstream can still have bugs, even if malice is never involved.

The spirit of Little Bobby Tables is likely alive and well in these kind of systems where messages are "only received from internal sources" and "therefore trusted".