Having clear API allows to have a clear boundary between trusted and untrusted environment in backend. If you don't check your arguments in REST endpoint, it's obvious bug and easy to spot. If it's just another method, well, you're not treating input in every function as a hostile.