[hanoz]

You might have site where all the validation is supposed to be done on the client side, and the only way an invalid model reaches the server is if somebody's up to mischief.

[DougWebb]

up to mischief could mean broken or disabled javascript. As-in, maybe something else on your page (third-party ads) loads javascript with an error that stops execution, but your form is still submitable because you've coded it properly as a standard html5 form.

[tuespetre]

Thank you. That makes sense, although upon first reading I was worried by 'validation supposed to be done on the client side' ;)