@lisihocke I think they should do that.
A BFF can be vulnerable.
As an entry point to the system, it can prevent attacks to the rest of the system.
Others should validate as well, depending on risks.