It is more “sanitize” than “validate” then. Saying that you need to sanitize disabled or normal fields in “crypto websites” is like saying that you need to put handrails on 7th floor of a red building to prevent falling down. But in reality you may fall from any height that has no handrails, and 7th floor and a red decoration aren’t specific requirements for falling.

I’m not trying to nitpick here, my confusion was genuine. These sorts of statements are hugely misleading even for seasoned folks (“what if I missed something in disabled inputs? why crypto suffers from that?”), and in novice developers it creates magic recipe thinking instead of generic awareness that you never want to execute(user_input).