As a minor point of order, the exact phrase "parse, don't validate" has been conventional wisdom in langsec circles since I got involved, so 2014 at the earliest.

I asked around on the work Matrix as to who actually coined it, but it's the weekend.

This is not to take anything away from @lexi_lambda, who cited her sources and documented an interesting type-theoretic approach to applying the principle. She did a great job!

If anyone wants to do a deeper dive, look into langsec, language-theoretic security. There's a lot of prior art to explore.